Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

用来帮你写周报把图文周报变成漂亮图片的skill--当前版本是苹果的风格

v1.0.0

周报助手 — 将用户的工作内容、周报、日报、总结一键生成一张 4:3 极简科技风汇报卡片(单张图,非多页PPT)。触发词:周报助手、周报卡片、日报卡片、一张图、汇报卡、生成卡片。

0· 67·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for chenpipi0807/weekly-newspaper-assistant.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "用来帮你写周报把图文周报变成漂亮图片的skill--当前版本是苹果的风格" (chenpipi0807/weekly-newspaper-assistant) from ClawHub.
Skill page: https://clawhub.ai/chenpipi0807/weekly-newspaper-assistant
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install weekly-newspaper-assistant

ClawHub CLI

Package manager switcher

npx clawhub@latest install weekly-newspaper-assistant
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description (generate a one-page 4:3 report card image) aligns with the runtime instructions (extract text, build HTML, screenshot to PNG). However, the SKILL.md assumes the presence of a headless Chrome/Chromium binary (and optionally puppeteer) and a writable ~/.openclaw/workspace path even though no required binaries or install steps are declared—this is an undeclared dependency.
!
Instruction Scope
Instructions tell the agent to 'read original content' and must include any user-sent images 100%, but do not define the exact source (conversation messages, uploaded files, or filesystem). The skill writes output to ~/.openclaw/workspace/card-YYYYMMDD.html and attempts to launch a local Chrome binary at a macOS-specific path to take a screenshot. It also pulls Tailwind and Google Fonts from CDNs. These behaviors involve filesystem writes and network access and should be explicit in the metadata; the lack of declared dependencies or explicit user consent is a concern.
Install Mechanism
This is instruction-only (no install spec), which is lower risk. But the instructions rely on external tooling (headless Chrome/Chromium or puppeteer) and remote CDNs for CSS/fonts; since no install or dependency list is provided, the skill will fail or behave unexpectedly on systems without those tools. The macOS-specific Chrome path may not exist on non-macOS systems.
Credentials
The skill does not request any environment variables, credentials, or config paths beyond writing to a subpath in the user's home. There is no disproportionate credential access requested.
Persistence & Privilege
always:false and the skill is not attempting to modify other skills or system-wide settings. It does, however, write output HTML to ~/.openclaw/workspace, which is persistent storage in the user's home; this is reasonable for a generator but should be documented and the path should be configurable or disclosed to users.
What to consider before installing
This skill appears to do what it says (generate a single 4:3 card image), but there are some missing details you should confirm before using it: - Confirm the platform/tooling: the SKILL.md expects a headless Chrome/Chromium (example macOS path shown) or puppeteer to take screenshots. The skill metadata does not declare this dependency. If you don't have Chrome/Chromium or puppeteer, the automatic screenshot step will fail; ask the author to declare required binaries or provide an alternative. - File writes: the skill saves HTML under ~/.openclaw/workspace/. If you care where files land, make sure you can change that path or inspect the saved HTML before screenshots are taken. - Network access: the generated HTML loads Tailwind and Google Fonts from CDNs (the SKILL.md even suggests mirrors). That means the skill will cause your environment to make outbound requests for styling assets; if you need offline or private rendering, request local assets or an option to inline styles. - Image inclusion: the instructions require including any user-sent images unmodified. Be cautious about including sensitive images; the skill will embed them into the card and potentially upload them if you later share the output. If you plan to enable this skill: ask the author to add an explicit dependency list (Chrome/Chromium or puppeteer), make the output path configurable, and document exactly where input content/images are read from. If you cannot get those assurances, consider running the skill in a sandboxed environment or only using it with non-sensitive inputs.

Like a lobster shell, security has layers — review code before you run it.

latestvk97brjtbx93z6fx3kfyny4j5xn84m59n
67downloads
0stars
1versions
Updated 2w ago
v1.0.0
MIT-0

周报助手

将任意工作内容提炼为一张 4:3 极简科技风汇报卡片。

核心理念

  • 一张图解决问题 — 不分页,不翻页,截图即用
  • 内容极度精炼 — 每条要点 ≤15 字,最多 6 条
  • 视觉层次清晰 — 标题 > 要点 > 标注,三层结构
  • 深色科技风 — 黑底 + 蓝/紫光斑 + 白字

生成流程

Step 1: 提炼内容

  • 读取原始内容
  • 提取核心要点(≤6 条)
  • 生成一个冲击力标题(≤12字)
  • 生成一句副标题/日期标注

Step 2: 生成 HTML 卡片

  • 比例严格 4:3(宽1200px × 高900px)
  • 单屏,无滚动,无翻页
  • 包含动态光斑背景动画
  • 使用 Tailwind CDN + Google Fonts(国内镜像)

Step 3: 截图输出

生成 HTML 后,使用以下命令截图为 PNG:

# 使用 puppeteer-screenshot 或 chromium headless
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome \
  --headless --screenshot=output.png \
  --window-size=1200,900 \
  --disable-gpu \
  file:///path/to/card.html

若截图命令不可用,直接告知用户打开 HTML 文件并截图。

图片处理规则(有图时必须严格遵守)

  1. 必须放入 — 用户发了图片,100% 要排进卡片,不能忽略
  2. 禁止裁切/遮挡 — 图片必须完整显示,使用 object-fit: contain + 等比缩放,绝对不用 coverclip
  3. 先算图再排版 — 计算图片数量和宽高比,确定图片区域大小,再安排文字布局(图片优先,文字自适应剩余空间)
  4. 多图时 — 纵向排列,每张图保持完整,不重叠

视觉规范

项目规范
比例4:3(1200×900px)
背景#000 + 模糊光斑(蓝/紫/青)
主标题白色,font-black,4~5rem(宁大勿小)
要点文字rgba(255,255,255,0.85),font-normal,1.05~1.2rem
标注文字rgba(255,255,255,0.35),font-light
强调色#60a5fa(蓝)/ #a78bfa(紫)/ #34d399(绿)
字体Noto Sans SC + Inter

卡片结构模板

无图版:

┌─────────────────────────────────────────────┐
│  [日期标注]                      [标识]     │
│                                              │
│  主标题(大,白,4~5rem,bold)              │
│  副标题                                      │
│  ─────────────────────────────────────────  │
│  • 要点一(1.1rem)                          │
│  • 要点二                                    │
│  • 要点三                                    │
│  [底部标注]                                  │
└─────────────────────────────────────────────┘

有图版(左文右图 或 上文下图,根据图片数量决定):

┌──────────────────────┬──────────────────────┐
│  主标题(3.5rem+)   │  [图片1 完整显示]    │
│  副标题              │                      │
│  ─────────────────── │  [图片2 完整显示]    │
│  • 要点一            │                      │
│  • 要点二            │  图片说明            │
│  [底部标注]          │                      │
└──────────────────────┴──────────────────────┘

严禁行为

  • 多页/翻页结构
  • 超过 8 个要点
  • 密集小字(要点字号 < 1rem)
  • 图片裁切、object-fit:cover、overflow:hidden 遮挡图片
  • 横向表格
  • 复杂图表

输出

  1. 保存为 ~/.openclaw/workspace/card-YYYYMMDD.html
  2. 尝试用 Chrome headless 截图为 PNG
  3. 发送卡片图片给用户

Comments

Loading comments...