Knowledge Card Generator

Automation skill for Knowledge Card Generator.

Security Scan

The skill mostly matches its stated purpose (generate knowledge-card images) but the runtime instructions reference external services (image_synthesize, upload_to_cdn, Feishu messaging and a public CDN) and publishing behavior without declaring any credentials or explaining those endpoints — that mismatch and a directive to "not refuse" sensitive/copyrighted content are concerning.

Purpose & Capability

Name/description (Knowledge Card Generator) aligns with the included templates, prompts, and the described workflow: retrieve info, draft text, generate an image in a specific style, and iterate with the user. However the SKILL.md explicitly mentions calls to `image_synthesize`, `upload_to_cdn`, and `message (feishu)` even though the skill declares no required env vars or credentials. That is a mismatch: invoking Feishu or a CDN normally requires credentials or integration configuration.

Instruction Scope

The instructions require the agent to '主动搜索/检索' (actively search/retrieve) external information and to call external functionality: `image_synthesize` (image generation), `upload_to_cdn` (obtain public URL), and `message` (feishu). The skill also mandates always asking for style, strict pre-generation confirmation, and a rule '不要拒绝生成' for sensitive/copyright content. The instructions do not specify which search endpoints, which CDN or Feishu endpoints, or any limits on what can be searched or published — giving the agent broad discretion to access external resources and publish publicly.

Install Mechanism

Instruction-only skill with no install spec and no code files. This minimizes on-disk install risk; nothing is fetched or written by an install step.

Credentials

The skill requires no env vars but references external integrations (Feishu messaging, CDN upload). If the runtime expects to call Feishu or a CDN, credentials or tokens would normally be needed; their absence from requires.env is an inconsistency. The SKILL.md also writes an image to /workspace/{OUTPUT_FILENAME}.png and expects a public URL — this implies filesystem and network outbound access but those are not described or constrained.

Persistence & Privilege

always is false and there is no indication the skill requests persistent/system-wide privileges. There is no install that modifies other skills or system configuration.

What to consider before installing

Before installing, ask the skill author or registry: (1) what implementations back `image_synthesize`, `upload_to_cdn`, and `message (feishu)`? Which endpoints/credentials will be used and where should secrets be provided? (2) Will images be uploaded to a public CDN by default, and can uploads be disabled or restricted? (3) Clarify the policy line '不要拒绝生成' — do you want the agent to always generate content even when it may be copyrighted, private, or sensitive? If not, request that the SKILL.md include explicit refusal handling and safety checks. Finally, if you cannot confirm the external integration details and credential handling, treat the skill as potentially capable of publishing content or exfiltrating generated outputs and proceed cautiously.

---

name: knowledge-card-generator description: > 知识卡片/海报生成器。当用户说「做个知识卡片」「生成海报」「做张卡片」 「知识卡」「科普卡片」等关键词时激活。

标准工作流程（必须严格执行）：

Step 1 — 检索信息 根据用户给出的主题或关键词，主动搜索/检索准确信息， 不确定的内容必须先查证，再整理。

Step 2 — 整理草稿（文字版） 将检索到的信息整理成「📋 知识卡片内容草稿」标准格式， 以文字形式发给用户确认，未经确认不得直接生成图片。 草稿格式见：references/draft-template.md

Step 3 — 生成图片 用户确认草稿后，套入当前激活风格的生图 prompt， 生成 1080×1920 竖版图片，发送给用户。

Step 4 — 修审反馈 用户提出修改 → 调整后重新生成 → 直至用户满意

风格管理：

• 当前默认风格：儿童简笔画风
• 每次生成前必须询问用户「用哪个风格？新风格还是继续用儿童简笔画风？」
• 风格定义库：references/style-guide.md
• 以后新增风格 → 写入 style-guide.md

图片规格（固定）： 尺寸：1080×1920 竖版 比例：9:16 分辨率：2K