by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's purpose (generate HTML PPTs) matches its instructions, but the runtime instructions reference an undeclared external tool and web scraping steps (apple.com.cn) that are not justified or declared, creating coherence and privacy concerns.
评估建议
This skill largely does what it says (create a Reveal.js HTML PPT), but the SKILL.md asks the agent to use an undeclared tool ('feishu_im_bot_image') to download uploads and to fetch product images from apple.com.cn. Before installing or using it, ask the publisher: (1) what is feishu_im_bot_image, why is it required, and what permissions/credentials does it need? (2) confirm whether the skill will actually access the public web (scraping) and whether your platform allows that; if so, what sites...详细分析 ▾
⚠ 用途与能力
Name/description (HTML PPT generator) align with the instructions to produce a Reveal.js single-file HTML. However the SKILL.md also instructs the agent to call a specific external tool ('feishu_im_bot_image') and to fetch product images from apple.com.cn. The Feishu tool is not declared in the skill's requirements or metadata, and scraping apple.com.cn is not necessary for the stated core functionality — these steps are outside the clear scope and are unexplained.
⚠ 指令范围
Instructions explicitly tell the agent to '调用 feishu_im_bot_image 工具下载用户上传的图片参考' (call feishu_im_bot_image) and to obtain product images from apple.com.cn. The skill does not declare that tool or explain credentials/permissions. The instruction to fetch external site images gives the agent open-ended web-access behavior and potential scraping of third-party content, which is beyond the core task of formatting user-supplied content and is not constrained or justified.
✓ 安装机制
No install specification or code files are present (instruction-only). This is lowest install risk — nothing is written to disk by an installer step.
ℹ 凭证需求
The skill declares no required environment variables or credentials — appropriate for its stated purpose. However, it references an external platform-specific tool (feishu_im_bot_image) which likely depends on platform capabilities or credentials not declared here; that mismatch should be clarified. Also fetching images from apple.com.cn may require no secret, but could raise copyright/privacy issues.
✓ 持久化与权限
always is false and there is no indication the skill requests persistent or elevated privileges. It does not modify other skills or system config in the instructions.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/18
- 首个版本发布，提供基于Reveal.js的HTML格式PPT自动生成能力。 - 支持收集用户主题、视觉风格（支持图片上传）、目标受众信息。 - 自动生成含封面、目录、内容、总结、结束页的单文件HTML PPT。 - 每页自动插入相关图标/图片，使用Font Awesome等公开资源丰富视觉效果。 - 生成的PPT支持本地保存及一键下载，内容和风格贴合用户需求。
● 无害
安装命令
点击复制官方npx clawhub@latest install mia-ppt-generator
镜像加速npx clawhub@latest install mia-ppt-generator --registry https://cn.longxiaskill.com 镜像可用