Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

一键生成PPT截图和缩略图工具,MAC版本

v1.0.1

自动将Mac版PPT转换为每页PNG截图及每6页缩略拼接图,支持自定义DPI和布局,自动分目录管理。

0· 375·0 current·0 all-time
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The code (ppt2png.py) implements the stated purpose: convert PPT → PDF with LibreOffice, PDF → PNG with Ghostscript, then assemble thumbnails. However SKILL.md asks the user to provide wechat_appid/wechat_appsecret/wechat_author in config.json even though neither config.json nor the Python code reference or use any WeChat fields. That mismatch is unexplained and atypical for this purpose.
!
Instruction Scope
Runtime instructions are generally scoped to reading config.json and processing the PPT; there are no network calls or file reads beyond the configured ppt and output directories. But SKILL.md instructs the user to add WeChat credentials to config.json (and to supply them), which the runtime does not use — this is scope creep and could be a leftover or misleading instruction. Also SKILL.md and config.json show absolute user paths; verify before running on a machine with different paths.
Install Mechanism
This is an instruction-only skill with a local Python script; there is no install specification. The SKILL.md asks to install ghostscript via brew and pillow via pip3 (reasonable and expected). No remote downloads or archive extraction are specified.
!
Credentials
The skill declares no required environment variables or credentials, but SKILL.md asks the user to supply wechat_appid and wechat_appsecret. Because the code does not use them, asking for secrets is disproportionate and unexplained. The provided config.json contains example absolute paths (pointing to a user's Desktop) — treat these as placeholders and update them to safe paths.
Persistence & Privilege
The skill does not request permanent presence (always:false) and does not modify other skills or system-wide agent settings. It only writes output files into configured output folders and a thumbnails subfolder.
What to consider before installing
This skill's code is straightforward and performs local file conversions; it does not perform network calls or exfiltrate data. However, SKILL.md asks you to provide WeChat credentials (wechat_appid / wechat_appsecret) even though the included Python script does not use them — do NOT supply any secrets into config.json unless you understand exactly why they are needed. Before running: (1) inspect and edit config.json to point to safe input/output paths (remove any paths left by the author), (2) remove any unused/secret fields such as wechat_appid/secret if present, (3) ensure LibreOffice and Ghostscript are installed from official sources, (4) run the script on a non-sensitive sample PPT first (or in a sandbox), and (5) consider fixing the thumbnail-resize logic (the code divides image size by 3 regardless of configured cols/rows). If the author can explain why WeChat credentials were requested, that could resolve the main inconsistency.

Like a lobster shell, security has layers — review code before you run it.

latestvk9751q5qvefceyvywkwqvrmqh182bn1r
375downloads
0stars
2versions
Updated 5h ago
v1.0.1
MIT-0

ppt2png

1、提示词输入:

mac系统某路径下某名字的PPT自动按页生成每一张截图和缩略图 例如:MAC系统,XXX路径下XXXPPT,帮我生成图片和3行3列的缩略图

2、config.json配置说明:

路径赋值给config.json 下的 ppt_dir

名字赋值给ppt_file

需要用户说明自己的wechat_appid,wechat_appsecret

微信公众号如需更改作者也可以更改:wechat_author

3、skill实现说明:

基于PPT → PDF(使用 LibreOffice) PDF → 每页 PNG(使用 Ghostscript) 每 9张图片生成 1 张缩略拼接图(3列 × 3行),可通过调整thumbnail_cols列,thumbnail_rows行来实现 兼容 Python 3.6

4、需要提前安装: brew install ghostscript pip3 install pillow

5、工作流程

主程序:ppt2png.py

配置文件:config.json

自动读取配置

支持修改 DPI、列数、行数、LibreOffice 路径、gs 路径

针对config.json 如果 which gs 输出是: /opt/homebrew/bin/gs

就改成:

"ghostscript_path": "/opt/homebrew/bin/gs"

Comments

Loading comments...