Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

课件帮 Aippt

v1.0.0

Generate professional PPT presentations using the 课件帮 (Kejian365) AI platform. Handles the full pipeline: outline generation, theme selection, AI content cre...

0· 67·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for good0007/kejian365-aippt.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "课件帮 Aippt" (good0007/kejian365-aippt) from ClawHub.
Skill page: https://clawhub.ai/good0007/kejian365-aippt
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install kejian365-aippt

ClawHub CLI

Package manager switcher

npx clawhub@latest install kejian365-aippt
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The code and SKILL.md clearly use the Kejian365 API and require an auth token (KEJIAN365_AUTH_TOKEN). However the registry metadata lists no required env vars or config paths — that metadata omission is inconsistent and could mislead users about what secrets are needed.
!
Instruction Scope
SKILL.md prescribes a linear workflow and instructs the agent to use the provided helper scripts rather than calling APIs directly. However the SKILL.md contains contradictory guidance: a 'HARD RULE' says NEVER show raw URLs/ppt_id/work_dir to the user, but the scripts print a view URL to stdout which the agent is instructed to parse and display (and Step 6 says to show the preview link). The instructions also require writing/reading state and params files in a workspace — the agent will read/write local files (task_state.json, params.json).
Install Mechanism
No install spec is present (instruction-only with small helper scripts). No external downloads or package installs are requested, which is appropriate for the described functionality.
!
Credentials
Only one credential is needed in practice (KEJIAN365_AUTH_TOKEN), which is proportional. But that credential is not declared in the registry metadata (inconsistency). The README additionally encourages pasting your token into chat (saving it in conversation memory) which is a privacy risk and not necessary given the env-var option.
!
Persistence & Privilege
The scripts persist state into a work directory (task_state.json) and explicitly save the auth token into that file under the key auth_token. This means the provided token can be written to disk in workspace paths (e.g., /mnt/user-data/workspace/...), potentially accessible later by other processes or skills. The skill does not request broader system privileges, but storing secrets to disk is a noteworthy persistence/privacy risk.
What to consider before installing
Things to consider before installing: - The code requires KEJIAN365_AUTH_TOKEN but the registry metadata does not declare this — expect to provide that env var or the script will fail. - Do NOT paste your real token directly into chat as suggested in README; prefer setting KEJIAN365_AUTH_TOKEN in a secure environment (or a scoped temporary token). Pasting into chat stores the secret in conversation history and is risky. - The helper script saves the auth token into task_state.json in the chosen work directory. If you install/use this skill, decide where work directories will live and who can access them; remove task_state.json after use if you don't want the token retained. - The SKILL.md contains contradictory rules about showing links/IDs vs. the scripts printing the view URL — confirm with the publisher how links will be handled so your tokens and raw URLs are not inadvertently exposed. - If you need stronger assurance: inspect the repository yourself, run the scripts locally with a temporary test token, or ask the publisher to (a) declare required env vars in registry metadata, (b) stop persisting auth_token to state files, and (c) avoid instructing users to paste tokens into chat. - Overall: the skill appears to implement the stated functionality, but the metadata/README/instructions mismatch and the token-on-disk behavior are meaningful risks you should address before trusting production secrets.

Like a lobster shell, security has layers — review code before you run it.

latestvk97bawmmt73gevn9bfcrgh1jh585dehq
67downloads
0stars
1versions
Updated 5d ago
v1.0.0
MIT-0

课件帮 AIPPT — 一句话生成专业 PPT

接入「课件帮」AI 平台,全流程自动完成 PPT 生成:大纲确认 → 模板匹配 → 智能生成 → 交付链接,无需手动操作任何 API。

适用场景

场景示例
商务汇报季度总结、战略分析
产品介绍融资 Pitch、新品发布
学术演示研究报告、毕业答辩
培训课件员工培训、技能分享

前提条件

需要环境变量:

KEJIAN365_AUTH_TOKEN=<Your_Token_Here>

密钥获取:https://kejian365.com/oapi-portal

使用方式

直接说:「帮我做一个关于 XX 的 PPT」即可启动。


<!-- 以下为 AI Agent 内部执行指令,用户无需关注 -->

Execution Checklist

Run through these steps in order. Track completion in context — never repeat a completed step.

[ ] Step 1  Gather requirements from user
[ ] Step 2  Generate outline (local LLM) → show to user → confirm
[ ] Step 3  run list_themes.py → pick theme → tell user
[ ] Step 4  Write params.json + run script (creates task ONCE on success)
[ ] Step 5  Re-run script every 30s to poll until terminal state
[ ] Step 6  Report final result

Hard rules:

  • NEVER call POST /skill/task/create directly — always use the script
  • NEVER change --work-dir for the same task (causes duplicates)
  • NEVER show ppt_id, work_dir, file paths, or raw URLs to the user

Script idempotency:

task_state.json statusScript behaviour
Missing / CREATE_FAILEDCalls create API (or retries)
PENDING / RUNNINGPolls only, never creates again
DONEReturns success immediately
GENERATION_FAILEDReturns failure; delete state file to retry

Step 1 — Gather Requirements

Ask in one message:

好的!请告诉我:

  1. PPT 的主题是什么?
  2. 有什么特别要求吗?(受众、风格、页数、语言等,没有就跳过)

Extract:

ParameterDefault
topicrequired
settingPages"智能决策""精简" ~10p / "标准" ~20p / "长篇" ~30p
settingLanguage"中文"
settingAudience"智能决策"
illustrationMode"standard" ("pro" = premium)

Step 2 — Generate Outline

Generate locally (no API). Then show the outline to the user and wait for confirmation:

已为您生成以下大纲,共 {N} 页:

  1. 封面 — {title}
  2. 目录 — {title} …(逐页列出)

满意的话我来继续选模板;如需调整请告诉我。

Outline array rules:

  • pageNumber sequential from 1, no gaps
  • Page 1 = 封面, last = 结束, at least 1 内容
  • Add 目录 when ≥ 6 pages; 章节 + its 内容 pages share chapterNumber
[
  { "pageNumber": 1, "pageType": "封面", "title": "主标题", "content": "" },
  { "pageNumber": 2, "pageType": "目录", "title": "目录", "content": "1. 概述\n2. 分析" },
  { "pageNumber": 3, "pageType": "章节", "title": "第一章", "content": "", "chapterNumber": "01" },
  { "pageNumber": 4, "pageType": "内容", "title": "内容页", "content": "...", "chapterNumber": "01" },
  { "pageNumber": 5, "pageType": "结束", "title": "谢谢", "content": "" }
]

Material (optional): also generate a short research summary to improve content quality and pass it as the material field.


Step 3 — Select Theme

Use the script — never call the API directly (raw JSON response is too large for context):

python kejian365-aippt/scripts/list_themes.py

Output per theme: THEME: theme_id|theme_name|style|scene

Reason over the full list, pick the theme_id that best fits the PPT topic, audience, and tone. Save it for Step 4 themeId.

Tell the user:

已为您选择「{theme_name}」模板({style} 风格 · {scene} 场景),即将开始生成…


Step 4 — Create Task

Work directory

Use a stable slug per topic — same task = same directory every time:

/mnt/user-data/workspace/{topic-slug}-ppt-tmp

params.json (UTF-8, no BOM, no \uXXXX escaping)

{
  "topic": "主题名称",
  "themeId": "theme_xxx",
  "outline": [ ... ],
  "authToken": "<credential>",
  "requirements": "用户的特别要求",
  "material": "# 研究摘要\n...",
  "themeConfig": {
    "settingPages": "标准",
    "settingLanguage": "中文",
    "settingAudience": "智能决策",
    "contentDepth": "智能生成",
    "illustration": "智能配图",
    "sourceMode": "智能参考"
  },
  "illustrationMode": "standard"
}

Run script

python kejian365-aippt/scripts/create_ppt_task.py \
  --params-file {work-dir}/params.json \
  --work-dir    {work-dir}

On SUBMITTED:, parse 查看链接: from stdout and say:

🎉 PPT 任务已创建成功! 主题:「{topic}」,模板:「{theme_name}」 生成大约需要 5–15 分钟,可以先点这里预览(生成完成前内容可能为空)。 我会每隔 30 秒自动查询进度,请稍候。


Step 5 — Poll Progress

Re-run every 30s (omit --params-file after first run):

python kejian365-aippt/scripts/create_ppt_task.py \
  --work-dir {work-dir}
ExitFirst lineAction
0SUBMITTED:Poll again in 30s
0DONE:→ Step 6
2PENDING:Report progress, poll again in 30s
1FAILED:→ Error handling

When pending, parse 进度: and 查看链接: and say:

正在生成中,已完成 {N}/{total} 页,完成后可在这里查看


Step 6 — Report Result

Success (DONE:)

Parse 主题: / 页数: / 查看链接: and say:

🎉 「{topic}」的 PPT 已生成完成,共 {N} 页! 点击这里查看您的 PPT

Provide raw URL only if the user explicitly asks.

Failure (FAILED:)

stdout keywordSay to user
余额不足账户余额不足,充值后告诉我,我来帮您重新生成。
鉴权 / 401 / 缺少账号凭证未检测到有效密钥,请配置环境变量: KEJIAN365_AUTH_TOKEN=your_token,密钥可到课件帮开放平台获取。
anything else生成时遇到了问题,要重新试一次吗?

Lines starting with [INTERNAL] are for the agent only — never show to user. Delete task_state.json silently to retry.


Appendix — API Reference

api-reference.md

Comments

Loading comments...