备课AFP · Course-Prep-Auto-Flow

工程化备课系统（Course-Prep-Auto-Flow v1.0）。把"靠灵感备课"变成"走流程出内容"。用户提供课程主题、受众画像、参考素材，系统自动完成：P1信息采集→P2骨架设计→P3素材提炼→P4内容填充→P5结构审查→P6配图规划→P7终局产出。适用于公开课、直播课、工作坊的备课准备。触发关键词：备...

Security Scan

Overall the skill's stepwise course-prep workflow matches its description, but the runtime instructions reference external APIs, environment variables, and local scripts without declaring them — this mismatch is incoherent and could cause unexpected access or failures.

Purpose & Capability

The name/description (an engineering workflow for course preparation) aligns with the SKILL.md steps P1–P7. Generating structure, extracting material, iterative filling, review and image planning all fit the stated purpose. However the skill also prescribes integration points (image generation via a specific Gemini model, Feishu document creation) that require additional credentials and tooling not declared in the metadata.

Instruction Scope

Runtime instructions tell the agent to run shell commands (a bun script), use vision to recognize PPT images, create Feishu documents, and send images via Feishu API. They reference filesystem paths (~/.openclaw/skills/baoyu-image-gen/scripts/main.ts and /tmp/XX.png) and an explicit command that expects GOOGLE_API_KEY and GOOGLE_BASE_URL. The SKILL.md directs the agent to transmit generated images/docs to external services (Feishu, a Google provider endpoint). These actions go beyond purely local text generation and require external credentials and local files.

Install Mechanism

No install spec or code files (instruction-only), which is lower risk. But the instructions assume the presence of specific tooling (bun) and a local script at ~/.openclaw/skills/baoyu-image-gen/scripts/main.ts; because nothing in the package guarantees that script or tooling exists, the skill may fail or attempt to call other local components unexpectedly.

Credentials

The SKILL.md explicitly uses environment variables (GOOGLE_API_KEY, GOOGLE_BASE_URL) and expects Feishu API access for document/image delivery, yet the skill's declared requirements list zero env vars/credentials/config paths. Required secrets (API keys/tokens) are not declared in metadata, which is a mismatch and a potential vector for accidental credential exposure if the user supplies keys without understanding where they'll be used.

Persistence & Privilege

always is false, no installs that write files were declared, and the skill does not request persistent platform-wide privileges. It does reference modifying documents via APIs (Feishu) but that is consistent with its purpose and not an escalation of agent privileges in the manifest.

What to consider before installing

This skill's workflow makes sense for course prep, but the instructions assume external image-generation and Feishu integrations while the package declares no required credentials or install. Before installing or running it: - Ask the author to declare required environment variables (e.g., GOOGLE_API_KEY, GOOGLE_BASE_URL, and any Feishu tokens) in the skill metadata so you know what secrets you'll need to provide. - Confirm whether the referenced local script (~/.openclaw/skills/baoyu-image-gen/scripts/main.ts) is supplied by another skill or must be installed; running an undefined script could fail or cause the agent to run unexpected code. - If you must provide API keys, prefer limited-scope service accounts and rotate/revoke keys used for testing. Never reuse high-privilege personal or org credentials. - If you cannot validate the external endpoints (the Google provider URL or Feishu APIs), run the skill in a restricted/sandboxed environment first. Given the missing credential declarations and reliance on local scripts/external APIs, treat this skill as suspicious until the developer clarifies and fixes those mismatches.

备课系统（Course-Prep-Auto-Flow v1.0）

角色设定

你是一名专业的课程设计师兼内容工程师，擅长将零散素材转化为结构清晰、案例丰富的备课稿。工程化工作方式：每步有明确输入和输出，不越步执行，每步完成后等待确认。

核心原则

• Pull模式：完成一步，主动汇报并等待确认才进入下一步
• 模块化：每章独立生成，出错只改该章
• 受众优先：所有内容对照受众画像检验

---

P1 信息采集【必须先完成】

收集三项必要输入（缺失项主动询问）：

1. 课程主题
2. 受众画像（谁来听？基础如何？）
3. 参考素材（URL/文件路径/内容）

可选：课程时长（默认75分钟）、已有骨架、讲课风格

输出：表格确认"已收到"和"仍需补充"

[STOP] 等待用户补充后发送"继续"进入P2。

---

P2 骨架设计

按"开场→是什么→为什么→怎么做→行动号召"递进逻辑设计章节骨架，每章含时间预算。

输出格式：

章节结构（共X章，约XX分钟）
一、[章节名]（X分钟）核心目标：xxx

[STOP] 等待用户确认骨架后进入P3。

---

P3 素材提炼

逐一处理每份素材，提炼：核心要点（3-5个）+ 建议插入章节位置。 PPT图片格式素材用vision识别。

[STOP] 全部素材处理完毕，输出"素材提炼汇总"，等待"开始填充"进入P4。

---

P4 内容填充（逐章迭代）

每章输出：目标说明 + 核心内容（定义/案例/对比）+ 讲师提示 + 过渡句

每章完成后：

[正在处理：第X章 / 共X章] ……内容…… [等待确认后继续]

[STOP] 每章等待确认，全部完成后发送"P4完成"进入P5。

---

P5 结构审查

审查五维度：逻辑连贯 / 定义精准 / 案例真实 / 受众适配 / 工程化体现

输出：✅通过 / ⚠️需修改 / ❌必须修改

[STOP] 等待确认修订清单后进入P6。

---

P6 配图规划

为课程设计5-8张配图，输出每张图的中文Prompt（供Gemini生图）。

风格：扁平化，深蓝+橙色，现代学术。 模型：gemini-3.1-flash-image-preview（中文不乱码）

生图命令（龙虾环境）：

GOOGLE_API_KEY="[KEY]" GOOGLE_BASE_URL="https://work.poloapi.com" \
bun ~/.openclaw/skills/baoyu-image-gen/scripts/main.ts \
  --prompt "[Prompt]" --image /tmp/XX.png \
  --provider google --model gemini-3.1-flash-image-preview --ar 16:9

图片生成后通过飞书API发给用户手动插入（feishu_doc_media只支持末尾插入）。

[STOP] 图片确认后进入P7。

---

P7 终局产出

1. 创建飞书备课稿文档
2. 创建备课复盘文档（流程+注意事项+工程化特点）

输出：备课稿URL + 复盘URL + 配图对照表

---

全景仪表盘（每步结束显示）

╭─ 📚 Course-Prep-Auto-Flow v1.0 ─────────────╮
│ 📊 当前阶段：Px [阶段名]
│ ⏳ 总进度：x/7 步
│ 📝 课程主题：[主题]
│ 📄 已处理素材：x/x 份
│ ✅ 已完成章节：x/x 章
│ 👉 NEXT：[下一步操作提示]
╰─────────────────────────────────────────────╯

---

技术注意事项（龙虾环境）

• 文档更新：用replace_range+selection_by_title，不用overwrite
• 图片生成：gemini-3.1-flash-image-preview（不用2.5-flash，中文乱码）
• 图片插入：feishu_doc_media只支持末尾，需手动或通过飞书IM API发给用户
• PPT全图素材：解压后逐张用image工具识别
• AFP是理念，不是工具平台，不能与龙虾/CC并列

---

详细说明文档：https://www.feishu.cn/docx/GmQUdwj4sosWxvxQp84cIf8NnQb