Aippt.Skip

AdvisoryAudited by Static analysis on May 9, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The skill can act through the user's authorized AIPPT account to start PPT generation tasks.

Why it was flagged

The script obtains an AIPPT credential through the helper script and sends it as an API key to the gateway. This is purpose-aligned, but it is still sensitive account authority.

Skill content
AIPPT_API_KEY=$(bash "${SKILL_DIR}/get-token.sh" 2>/dev/null) ... -H "X-API-Key: ${AIPPT_API_KEY}"
Recommendation

Install only if you intend to authorize AIPPT use, and verify the AIPPT integration is connected to the correct account.

What this means

Any business plans, private content, or other sensitive details included in the PPT prompt may leave the local agent environment.

Why it was flagged

The user's PPT description is sent to a remote Design Agent API through the gateway.

Skill content
本技能调用远程 Design Agent API,根据文字描述自动生成专业 PPT 演示文稿
Recommendation

Avoid including confidential information in the prompt unless you are comfortable sending it to the AIPPT/智绘高迪 service.

NoteHigh Confidence
ASI10: Rogue Agents
What this means

A PPT generation task may keep running after the agent reports that it has been submitted, potentially spending AIPPT credits until it completes or is stopped on the platform.

Why it was flagged

The documentation discloses that generation continues in the background after the script returns and can continue consuming platform credits.

Skill content
PPT 后台生成过程会持续消耗积分 ... Gateway 立即返回 JSON 结果给脚本,**不等待 PPT 生成完成**
Recommendation

Review the credit cost before use, specify page/count expectations when needed, and use the returned workspace link to monitor or stop the task.