📦
skywork-excel
38إنشاء تقارير Excel باستخدام Skywork
غالبا ما يتطلب العمل على جداول البيانات صيغاً ومخططات وتحويل ملفات وتنسيقا دقيقا. ترسل هذه المهارة المهمة إلى Skywork Excel Agent لإنتاج ملفات Excel أو تقارير HTML.
المكتب والتقارير عرض
المهارات skywork-ppt
📦
skywork-ppt
مراجعة المحتوى r1 مخاطر عالية 🌐 الوصول إلى الشبكة🔑 متغيرات البيئة📁 الوصول إلى نظام الملفات⚙️ الأوامر الخارجية
إنشاء عروض PowerPoint باستخدام Skywork
قد يتطلب بناء عروض تقديمية مصقولة من موضوعات خام أو ملفات أو قوالب العديد من الخطوات اليدوية. تقوم هذه المهارة بأتمتة توليد PPTX ومحاكاة القوالب والتحرير وعمليات الشرائح المحلية من خلال سير عمل Skywork.
يدعم: Claude Codex Code(CC)
توقف واطلب التأكيد قبل التثبيت.
راجع الخطة واحصل على موافقة صريحة من المستخدم قبل تغيير الملفات.
التثبيت باستخدام Agent لدي
انسخ هذا الطلب إلى Agent لديك. يتضمن صفحة Skill المعتمدة وملف manifest.
طلب الوكيل
Review the Skillstore skill "skywork-ppt" from https://skillstore.io/skills/skyworkai-skywork-ppt.md and its manifest at https://skillstore.io/api/skills/skyworkai-skywork-ppt/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.يجب أن يواصل Agent عرض خطته وطلب أي تأكيد تفرضه سياسة الأمان.
موارد مهيّأة لـ Agents
استخدم هذه الروابط عندما يحتاج AI Agent أو crawler أو script إلى سياق نظيف بدلًا من قراءة الصفحة كاملة.
اختبرها
جارٍ استخدام "skywork-ppt". أنشئ عرضا باللغة الإنجليزية من 6 شرائح عن أتمتة دعم العملاء لاجتماع قيادي.
النتيجة المتوقعة:
تعيد المهارة مسار PPTX مولدا ورابط تنزيل وعنوان العرض التقديمي ووصفا موجزا لكل شريحة.
جارٍ استخدام "skywork-ppt". استخدم قالبي المحلي وأنشئ عرضا تقديميا جديدا لإطلاق منتج.
النتيجة المتوقعة:
ترفع المهارة القالب وتولد PPTX جديدا بتخطيط مشابه وتبلغ عن ملف القالب الذي تم استخدامه.
جارٍ استخدام "skywork-ppt". احذف الشريحتين 3 و7 من ملف PPTX هذا واحفظ نسخة مختصرة.
النتيجة المتوقعة:
تشغل المهارة عملية شرائح محلية وتبلغ عن مسار PPTX المحفوظ مع تغيير عدد الشرائح المكتمل.
التدقيق الأمني
مخاطر عاليةv4 • ٧/٧/٢٠٢٦ فتح التقرير المرتبط بالإصدار
The skill has legitimate presentation-generation functionality, but it depends heavily on external Skywork APIs, local file uploads, token handling, and command execution. I confirmed the high-risk token cache, browser-launch subprocesses, document upload paths, and several filesystem risks, while dismissing Markdown backtick and placeholder URL false positives. No prompt injection attempt was found in the reviewed files.
12
الملفات التي تم فحصها
2,255
الأسطر التي تم تحليلها
95
عناصر المراجعة
0
تم تجاهل الإيجابيات الكاذبة
مخاوف أمنية مؤكدة (6)
مرتفع
workflow_generate.md:7-10scripts/parse_file.py:41-42workflow_imitate.md:82-89scripts/upload_files.py:68-80
Third-Party Upload of Local Presentation Inputs
The workflows and scripts upload user-provided documents, templates, or PPTX files to Skywork services for parsing, storage, or generation. This is expected functionality, but it can disclose sensitive local files if the user has not given explicit approval.
The workflow text explicitly tells the agent to upload reference files or templates, and the scripts read file bytes before POSTing to Skywork endpoints.
مرتفع
Persistent Token Cache Without Permission Hardening
The authentication flow caches Skywork token data in ~/.skywork_token and reloads it later. The write path does not apply restrictive permissions or use an operating system credential store.
The token cache path and JSON write are direct, and I found no chmod, keychain, or permission check around the stored credential.
مرتفع
Query-Controlled Search Result File Path
The web search script builds an output filename from the raw query string before writing search results. A crafted query containing path separators or an absolute path can influence where the result file is written.
The query comes from CLI arguments, is concatenated into the filename, and is passed to open() without sanitization or basename normalization.
منخفض
System reconnaissance
3. No valid token → opens browser for login, polls until complete, saves token
The instructions state that the login flow opens a browser, polls for completion, and saves a token. This is security relevant authentication behavior.
منخفض
System reconnaissance
**This skill requires Python 3 (>=3.8). Run the following before any script to locate a valid Python
The instructions enumerate candidate Python binaries with command -v and test versions. This is limited host inspection for dependency setup.
منخفض
System reconnaissance
After writing the reference report, save it to a local temp file to avoid shell encoding issues:
The workflow instructs saving a reference report to a temp file. It is not reconnaissance, but it is still filesystem behavior with potentially sensitive content.
عناصر مراجعة القدرات (95)
هذه قدرات محلية حقيقية قد يُتوقع وجودها لهذه المهارة، لذا فهي تتطلب مراجعة ولكن لا تُحتسب كسلوك خبيث مؤكد.
مرتفع
Python subprocess.Popen
subprocess.Popen(["open", url], start_new_session=True,
The authentication flow spawns OS commands to open a browser, and the Windows branch uses shell=True. The commands are fixed, but launching external processes from a skill is a real execution risk.
مرتفع
Python subprocess.Popen
subprocess.Popen(["start", url], shell=True, start_new_session=True,
The authentication flow spawns OS commands to open a browser, and the Windows branch uses shell=True. The commands are fixed, but launching external processes from a skill is a real execution risk.
مرتفع
Python subprocess.Popen
subprocess.Popen(["xdg-open", url], start_new_session=True,
The authentication flow spawns OS commands to open a browser, and the Windows branch uses shell=True. The commands are fixed, but launching external processes from a skill is a real execution risk.
مرتفع
Hidden file in home directory
Token is stored in user home directory as ~/.skywork_token (JSON format).
The skill stores or documents a persistent Skywork token in ~/.skywork_token in the user home directory. A cached bearer token can be reused by other local processes or users if permissions are weak.
مرتفع
Hidden file in home directory
TOKEN_FILE = os.path.expanduser("~/.skywork_token")
The skill stores or documents a persistent Skywork token in ~/.skywork_token in the user home directory. A cached bearer token can be reused by other local processes or users if permissions are weak.
مرتفع
Hidden file access
Token is stored in user home directory as ~/.skywork_token (JSON format).
The skill stores or documents a persistent Skywork token in ~/.skywork_token in the user home directory. A cached bearer token can be reused by other local processes or users if permissions are weak.
مرتفع
Hidden file access
TOKEN_FILE = os.path.expanduser("~/.skywork_token")
The skill stores or documents a persistent Skywork token in ~/.skywork_token in the user home directory. A cached bearer token can be reused by other local processes or users if permissions are weak.
مرتفع
Python file write/append
with open(TOKEN_FILE, "w", encoding="utf-8") as f:
The script writes token data to the persistent ~/.skywork_token cache. The code does not set restrictive file permissions around the credential write.
مرتفع
Python HTTP libraries
import urllib.request
The script reads local files and uploads their full bytes to Skywork object storage through the gateway. This is a direct exfiltration surface for sensitive files if invoked without clear consent.
مرتفع
Python HTTP libraries
req = urllib.request.Request(
The script reads local files and uploads their full bytes to Skywork object storage through the gateway. This is a direct exfiltration surface for sensitive files if invoked without clear consent.
مرتفع
Python HTTP libraries
with urllib.request.urlopen(req, timeout=60) as resp:
The script reads local files and uploads their full bytes to Skywork object storage through the gateway. This is a direct exfiltration surface for sensitive files if invoked without clear consent.
مرتفع
Python file write/append
with open(out_path, "w", encoding="utf-8") as f:
The script writes search results to a filename derived from the raw query string. A crafted query can influence the output path and leave sensitive search context on disk.
مرتفع
Hidden file in home directory
2. Cached token file `~/.skywork_token` → validate via API, if valid, use it
The instructions explicitly use a cached ~/.skywork_token credential file. Persistent hidden-token storage is a real credential exposure risk.
مرتفع
Hidden file access
2. Cached token file `~/.skywork_token` → validate via API, if valid, use it
The instructions explicitly use a cached ~/.skywork_token credential file. Persistent hidden-token storage is a real credential exposure risk.
متوسط
Python HTTP libraries
from urllib.request import Request, urlopen
The script uploads user-provided files to the Skywork Office parse service and streams results back. This is a real external data transfer risk for sensitive documents.
متوسط
Hardcoded URL
SKYWORK_OFFICE_URL - Base URL (default: https://api-tools.skywork.ai/theme-gateway)
The script uploads user-provided files to the Skywork Office parse service and streams results back. This is a real external data transfer risk for sensitive documents.
متوسط
Python file write/append
with open(args.output, "w", encoding="utf-8") as f:
The optional output path writes parsed document content to disk. A user-controlled path can overwrite writable files or leave sensitive extracted text behind.
متوسط
Python HTTP libraries
import urllib.request
The script sends prompts, references, uploaded file metadata, and tokens to Skywork generation or edit APIs, then downloads the PPTX result. This is intentional but security relevant network transfer.
متوسط
Python HTTP libraries
req = urllib.request.Request(
The script sends prompts, references, uploaded file metadata, and tokens to Skywork generation or edit APIs, then downloads the PPTX result. This is intentional but security relevant network transfer.
متوسط
Python HTTP libraries
with urllib.request.urlopen(req, timeout=600) as resp:
The script sends prompts, references, uploaded file metadata, and tokens to Skywork generation or edit APIs, then downloads the PPTX result. This is intentional but security relevant network transfer.
متوسط
Python HTTP libraries
req2 = urllib.request.Request(download_url, method="GET")
The script sends prompts, references, uploaded file metadata, and tokens to Skywork generation or edit APIs, then downloads the PPTX result. This is intentional but security relevant network transfer.
متوسط
Python HTTP libraries
with urllib.request.urlopen(req2, timeout=120) as r:
The script sends prompts, references, uploaded file metadata, and tokens to Skywork generation or edit APIs, then downloads the PPTX result. This is intentional but security relevant network transfer.
متوسط
Temp directory access
log_file = f"/tmp/ppt_run_{session_id}.log" if args.log_path == "" else args.log_path
The script creates or appends log files and writes the generated PPTX to a caller-controlled output path. This can expose content in logs or overwrite writable files if paths are unsafe.
متوسط
Python file write/append
with open(log_file, "a", encoding="utf-8") as f:
The script creates or appends log files and writes the generated PPTX to a caller-controlled output path. This can expose content in logs or overwrite writable files if paths are unsafe.
متوسط
Python file write/append
open(log_file, "w").close() # clear previous run
The script creates or appends log files and writes the generated PPTX to a caller-controlled output path. This can expose content in logs or overwrite writable files if paths are unsafe.
متوسط
Python file write/append
with open(out_abs, "wb") as f:
The script creates or appends log files and writes the generated PPTX to a caller-controlled output path. This can expose content in logs or overwrite writable files if paths are unsafe.
متوسط
Hardcoded URL
API_BASE = os.environ.get("SKYWORK_API_BASE", "https://api.skywork.ai")
The authentication module contacts Skywork login and token validation endpoints. This sends authentication state to an external service and is security relevant.
متوسط
Hardcoded URL
LOGIN_BASE_URL = os.environ.get("SKYWORK_WEB_BASE", "https://skywork.ai")
The authentication module contacts Skywork login and token validation endpoints. This sends authentication state to an external service and is security relevant.
متوسط
Python environment access
API_BASE = os.environ.get("SKYWORK_API_BASE", "https://api.skywork.ai")
The API and web login bases are environment-overridable. This can redirect authentication traffic if the environment is not trusted.
متوسط
Python environment access
LOGIN_BASE_URL = os.environ.get("SKYWORK_WEB_BASE", "https://skywork.ai")
The API and web login bases are environment-overridable. This can redirect authentication traffic if the environment is not trusted.
متوسط
Python environment access
env_token = os.environ.get("SKYBOT_TOKEN", "")
The script reads SKYBOT_TOKEN from the environment and uses it as an authentication token. Environment-sourced credentials are sensitive and later authorize network calls.
متوسط
Python environment access
env_token = os.environ.get("SKYBOT_TOKEN", "")
The script reads SKYBOT_TOKEN from the environment and uses it as an authentication token. Environment-sourced credentials are sensitive and later authorize network calls.
متوسط
Python HTTP libraries
import urllib.request
The script sends search queries to a Skywork web search API with an authentication token. Queries can contain sensitive project or business context.
متوسط
Python HTTP libraries
req = urllib.request.Request(
The script sends search queries to a Skywork web search API with an authentication token. Queries can contain sensitive project or business context.
متوسط
Python HTTP libraries
with urllib.request.urlopen(req, timeout=30) as resp:
The script sends search queries to a Skywork web search API with an authentication token. Queries can contain sensitive project or business context.
متوسط
Temp file creation
import tempfile
The script creates a temporary directory for search result files. Temporary storage is legitimate but can retain sensitive query results after the run.
متوسط
Temp file creation
out_dir = tempfile.mkdtemp(prefix="web_search_")
The script creates a temporary directory for search result files. Temporary storage is legitimate but can retain sensitive query results after the run.
متوسط
Ruby/shell backtick execution
```bash
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
متوسط
Ruby/shell backtick execution
```
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
متوسط
Ruby/shell backtick execution
1. Environment variable `SKYBOT_TOKEN` → if set, use directly
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
متوسط
Ruby/shell backtick execution
2. Cached token file `~/.skywork_token` → validate via API, if valid, use it
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
متوسط
Ruby/shell backtick execution
**IMPORTANT - Login URL handling**: If script output contains a line starting with `[LOGIN_URL]`, yo
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
متوسط
Ruby/shell backtick execution
```bash
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
متوسط
Ruby/shell backtick execution
```
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
متوسط
Ruby/shell backtick execution
> After this check, replace `python` with the discovered `$PYTHON_CMD` (e.g. `python3`) in all subse
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
متوسط
Ruby/shell backtick execution
0. **REQUIRED FIRST STEP** — Read [workflow_generate.md](workflow_generate.md) NOW, before taking an
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
متوسط
Ruby/shell backtick execution
1. **Environment check** — run the check above to get `$PYTHON_CMD`.
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
متوسط
Ruby/shell backtick execution
2. **Upload reference files** (if the user provides local files as content source) — parse the file
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
متوسط
Ruby/shell backtick execution
3. **Web search** (required if no relevant content is already in the conversation) — call web_search
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
متوسط
Ruby/shell backtick execution
> **Important**: set exec tool `yieldMs` to `600000` (10 minutes).
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
متوسط
Ruby/shell backtick execution
5. **Deliver** — provide the absolute `.pptx` path and the download URL.
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
متوسط
Ruby/shell backtick execution
1. **Environment check** — run the check above to get `$PYTHON_CMD`.
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
متوسط
Ruby/shell backtick execution
2. **Locate the template** — extract the absolute path of the local `.pptx` from the user's message;
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
متوسط
Ruby/shell backtick execution
3. **Upload the template** — upload it and extract `TEMPLATE_URL` from the output.
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
متوسط
Ruby/shell backtick execution
4. **Upload reference files** (if the user provides additional local files as content source) — pars
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
متوسط
Ruby/shell backtick execution
5. **Web search** (required if no relevant content is already in the conversation) — call web_search
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
متوسط
Ruby/shell backtick execution
> **Important**: set exec tool `yieldMs` to `600000` (10 minutes).
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
متوسط
Ruby/shell backtick execution
7. **Deliver** — provide the absolute `.pptx` path, the download URL, and the template filename used
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
متوسط
Ruby/shell backtick execution
1. **Environment check** — run the check above to get `$PYTHON_CMD`.
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
متوسط
Ruby/shell backtick execution
3. **Run the script** with `--pptx-url`:
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
متوسط
Ruby/shell backtick execution
```bash
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
متوسط
Ruby/shell backtick execution
```
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
متوسط
Ruby/shell backtick execution
> **Important**: set exec tool `yieldMs` to `600000` (10 minutes).
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
متوسط
Ruby/shell backtick execution
```bash
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
متوسط
Ruby/shell backtick execution
```
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
متوسط
Ruby/shell backtick execution
- **Insufficient benefit**: When calling scripts (generate, imitate, or edit), the script or log may
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
متوسط
Ruby/shell backtick execution
- **Format**: One short sentence in the user's language + a link like `[Upgrade now →](url)` or the
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
متوسط
Ruby/shell backtick execution
- **URL**: Extract the upgrade URL from the log/script output (e.g. the `at https://...` part).
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
متوسط
Ruby/shell backtick execution
- **Python 3.8+** (required) — `python3` / `python` must be on PATH
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
متوسط
Shell command substitution
echo "Found Python: $PYTHON_CMD ($($PYTHON_CMD --version))"
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
متوسط
Template literal with command substitution
```bash
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
متوسط
Shell command substitution
PPT_LOG=/tmp/ppt_$(date +%s).log
The workflow instructs shell command substitution while running and monitoring background PPT jobs. It is expected process control, but it requires local command execution.
متوسط
Shell command substitution
PPT_PID=$(grep '^\[PID\]' "$PPT_LOG" | tail -1 | awk '{print $2}')
The workflow instructs shell command substitution while running and monitoring background PPT jobs. It is expected process control, but it requires local command execution.
متوسط
Temp directory access
PPT_LOG=/tmp/ppt_$(date +%s).log
The workflow creates a predictable timestamp-based log file under /tmp. Logs may contain PPT progress or error details and can persist after execution.
متوسط
Shell command substitution
PPT_LOG=/tmp/ppt_$(date +%s).log
The workflow instructs shell command substitution while running and monitoring background PPT jobs. It is expected process control, but it requires local command execution.
متوسط
Shell command substitution
PPT_PID=$(grep '^\[PID\]' "$PPT_LOG" | tail -1 | awk '{print $2}')
The workflow instructs shell command substitution while running and monitoring background PPT jobs. It is expected process control, but it requires local command execution.
متوسط
Temp directory access
cat > /tmp/ppt_reference.md << 'REFERENCE_EOF'
The workflow writes reference material and logs under /tmp using predictable names. These files can contain sensitive source content or generation details.
متوسط
Temp directory access
- **--reference-file** (optional): Pass the path to the temp file written at the end of Step 2 (e.g.
The workflow writes reference material and logs under /tmp using predictable names. These files can contain sensitive source content or generation details.
متوسط
Temp directory access
PPT_LOG=/tmp/ppt_$(date +%s).log
The workflow writes reference material and logs under /tmp using predictable names. These files can contain sensitive source content or generation details.
متوسط
Temp directory access
--reference-file /tmp/ppt_reference.md \
The workflow writes reference material and logs under /tmp using predictable names. These files can contain sensitive source content or generation details.
متوسط
Shell command substitution
PPT_LOG=/tmp/ppt_$(date +%s).log
The workflow instructs shell command substitution while running and monitoring background PPT jobs. It is expected process control, but it requires local command execution.
متوسط
Shell command substitution
PPT_PID=$(grep '^\[PID\]' "$PPT_LOG" | tail -1 | awk '{print $2}')
The workflow instructs shell command substitution while running and monitoring background PPT jobs. It is expected process control, but it requires local command execution.
متوسط
Temp directory access
cat > /tmp/ppt_reference.md << 'REFERENCE_EOF'
The workflow writes reference material, uses /tmp paths, or documents template paths. Temporary files and local paths can expose sensitive presentation content.
متوسط
Temp directory access
- **--reference-file** (optional): Path to the temp file written at the end of Step 3 (e.g. `/tmp/pp
The workflow writes reference material, uses /tmp paths, or documents template paths. Temporary files and local paths can expose sensitive presentation content.
متوسط
Temp directory access
PPT_LOG=/tmp/ppt_$(date +%s).log
The workflow writes reference material, uses /tmp paths, or documents template paths. Temporary files and local paths can expose sensitive presentation content.
متوسط
Temp directory access
--reference-file /tmp/ppt_reference.md \
The workflow writes reference material, uses /tmp paths, or documents template paths. Temporary files and local paths can expose sensitive presentation content.
متوسط
Temp directory access
| Use this template to make a PPT on AI trends — template at `/tmp/style.pptx` | ✅ Imitate |
The workflow writes reference material, uses /tmp paths, or documents template paths. Temporary files and local paths can expose sensitive presentation content.
منخفض
Hardcoded URL
SKYWORK_AUTH_API_BASE = "https://api.skywork.ai"
This config defines external Skywork API endpoints that the skill uses for authentication, parsing, upload, search, and PPT generation. Network destinations are expected but still require disclosure and trust in a third-party service.
منخفض
Hardcoded URL
SKYWORK_WEB_BASE = "https://skywork.ai"
This config defines external Skywork API endpoints that the skill uses for authentication, parsing, upload, search, and PPT generation. Network destinations are expected but still require disclosure and trust in a third-party service.
منخفض
Hardcoded URL
SKYWORK_OFFICE_URL = os.environ.get("SKYWORK_OFFICE_URL", "https://api.skywork.ai/skywork-office-rou
This config defines external Skywork API endpoints that the skill uses for authentication, parsing, upload, search, and PPT generation. Network destinations are expected but still require disclosure and trust in a third-party service.
منخفض
Hardcoded URL
SKYWORK_GATEWAY_URL = os.environ.get("SKYWORK_GATEWAY_URL", "https://api-tools.skywork.ai/theme-gate
This config defines external Skywork API endpoints that the skill uses for authentication, parsing, upload, search, and PPT generation. Network destinations are expected but still require disclosure and trust in a third-party service.
منخفض
Python environment access
SKYWORK_OFFICE_URL = os.environ.get("SKYWORK_OFFICE_URL", "https://api.skywork.ai/skywork-office-rou
The service base URL can be overridden from the environment. That is useful for deployment but can redirect uploads or tokens if the execution environment is compromised.
منخفض
Python environment access
SKYWORK_GATEWAY_URL = os.environ.get("SKYWORK_GATEWAY_URL", "https://api-tools.skywork.ai/theme-gate
The service base URL can be overridden from the environment. That is useful for deployment but can redirect uploads or tokens if the execution environment is compromised.
منخفض
Python environment access
payload["source_platform"] = "skyclaw" if os.environ.get("POD_TYPE", "") == "skyclaw" else ""
The script reads POD_TYPE from the environment to set source_platform. The value is low sensitivity but confirms environment-dependent behavior.
منخفض
Python environment access
payload = {"query": query, "source_platform": "skyclaw" if os.environ.get("POD_TYPE", "") == "skycla
The script reads POD_TYPE from the environment to set source_platform. This is low sensitivity but confirms environment-dependent behavior.
عوامل الخطر
🌐 الوصول إلى الشبكة (34)
scripts/config.py:9 scripts/config.py:12 scripts/config.py:16 scripts/config.py:19 scripts/local_pptx_ops.py:91 scripts/parse_file.py:24 scripts/parse_file.py:12 scripts/run_ppt_write.py:16 scripts/run_ppt_write.py:296 scripts/run_ppt_write.py:305 scripts/run_ppt_write.py:328 scripts/run_ppt_write.py:329 scripts/run_ppt_write.py:231 scripts/skywork_auth.py:41 scripts/skywork_auth.py:42 scripts/upload_files.py:15 scripts/upload_files.py:81 scripts/upload_files.py:91 scripts/upload_files.py:106 scripts/web_search.py:14 scripts/web_search.py:24 scripts/web_search.py:31 SKILL.md:61 SKILL.md:115 SKILL.md:156 workflow_edit.md:49 workflow_generate.md:21 workflow_generate.md:27 workflow_generate.md:28 workflow_generate.md:133 workflow_imitate.md:46 workflow_imitate.md:52 workflow_imitate.md:53 workflow_imitate.md:117
🔑 متغيرات البيئة (8)
📁 الوصول إلى نظام الملفات (33)
scripts/parse_file.py:157 scripts/run_ppt_write.py:244 scripts/run_ppt_write.py:34 scripts/run_ppt_write.py:245 scripts/run_ppt_write.py:330 scripts/skywork_auth.py:6 scripts/skywork_auth.py:44 scripts/skywork_auth.py:6 scripts/skywork_auth.py:44 scripts/skywork_auth.py:172 scripts/upload_files.py:106 scripts/web_search.py:13 scripts/web_search.py:60 scripts/web_search.py:71 SKILL.md:28 SKILL.md:28 SKILL.md:53 workflow_edit.md:52 workflow_edit.md:73 workflow_edit.md:45 workflow_generate.md:136 workflow_generate.md:156 workflow_generate.md:87 workflow_generate.md:117 workflow_generate.md:128 workflow_generate.md:132 workflow_imitate.md:120 workflow_imitate.md:141 workflow_imitate.md:74 workflow_imitate.md:100 workflow_imitate.md:111 workflow_imitate.md:116 workflow_imitate.md:187
⚙️ الأوامر الخارجية (43)
scripts/skywork_auth.py:87 scripts/skywork_auth.py:90 scripts/skywork_auth.py:93 SKILL.md:21-24 SKILL.md:24-27 SKILL.md:27-28 SKILL.md:28-31 SKILL.md:31-50 SKILL.md:50-69 SKILL.md:69-71 SKILL.md:71 SKILL.md:78-79 SKILL.md:79-80 SKILL.md:80 SKILL.md:81-83 SKILL.md:83 SKILL.md:84-92 SKILL.md:92-93 SKILL.md:93-94 SKILL.md:94-95 SKILL.md:95 SKILL.md:96-98 SKILL.md:98 SKILL.md:99-109 SKILL.md:109-111 SKILL.md:111-112 SKILL.md:112-117 SKILL.md:117-118 SKILL.md:118 SKILL.md:125-140 SKILL.md:140-148 SKILL.md:148-155 SKILL.md:155-156 SKILL.md:156-162 SKILL.md:162 SKILL.md:65 SKILL.md:50-69 workflow_edit.md:45 workflow_edit.md:71 workflow_generate.md:128 workflow_generate.md:154 workflow_imitate.md:111 workflow_imitate.md:139
الأنماط المكتشفة
System reconnaissance×3
دقّقه: codex عرض سجل التدقيق →
شارك واستشهد بهذا التقرير
شارك تقرير التقييم المرتبط بالإصدار والشارة المحايدة وبطاقة التضمين والاستشهادات. تعرض Skillstore الأدلة من دون أن تقرر ما إذا كانت هذه المهارة آمنة.
نسخ رابط التقرير
https://skillstore.io/skills/skyworkai-skywork-ppt/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportشارة Markdown
[](https://skillstore.io/skills/skyworkai-skywork-ppt?utm_source=security_passport_badge)شارة HTML
<a href="https://skillstore.io/skills/skyworkai-skywork-ppt?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/skyworkai-skywork-ppt/security.svg" alt="Skillstore security assessment" loading="lazy"></a>بطاقة قابلة للتضمين
<iframe src="https://skillstore.io/embed/skills/skyworkai-skywork-ppt.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>الاستشهادات الأكاديمية (APA · BibTeX · CFF)
اقتباس APA
SkyworkAI. (2026). skywork-ppt security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/skyworkai-skywork-ppt/audits/4اقتباس BibTeX
@techreport{skyworkai-skyworkai-skywork-ppt-2026,
author = {SkyworkAI},
title = {skywork-ppt security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/skyworkai-skywork-ppt/audits/4},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "skywork-ppt security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
- name: "SkyworkAI"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/skyworkai-skywork-ppt/audits/4"
identifiers:
- type: other
value: "skillstore:skyworkai-skywork-ppt:audit:4"
description: "Skillstore immutable audit report identifier"
تقييم Skillstore
سبب هذا التقييم موثوقية الأدلة: متوسط 45
الهندسة المعمارية
85
قابلية الصيانة
87
المحتوى
69
المجتمع
83
الامتثال للمواصفات
ما الذي يمكنك بناؤه
إنشاء عرض موجز من موضوع
حوّل موضوعا وجمهورا وعدد شرائح وملاحظات داعمة إلى PPTX مولد مع سجلات تقدم ورابط تنزيل.
إعادة استخدام نمط عرض تقديمي للشركة
ارفع قالب PPTX وأنشئ عرضا جديدا يتبع تخطيط القالب وبنيته المرئية.
تنظيف ملف شرائح موجود
افحص الشرائح أو احذفها أو أعد ترتيبها أو استخرجها أو ادمجها محليا دون إرسال العرض إلى واجهة التوليد الخلفية.
جرّب هذه الموجّهات
توليد عرض بسيط
أنشئ PPTX باللغة الإنجليزية عن اتجاهات الطاقة المتجددة لجمهور أعمال عام. استخدم 8 شرائح ونمطا احترافيا نظيفا.
التوليد من ملفات مرجعية
أنشئ موجزا للمستثمرين من 10 شرائح من تقرير السوق المرفق. حافظ على الأرقام الرئيسية والتواريخ وأسماء الشركات كما هي تماما.
محاكاة نمط قالب
استخدم قالب PPTX في هذا المسار المحلي وأنشئ عرضا من 12 شريحة عن خارطة طريق منتجاتنا لعام 2026. طابق بنية القالب.
تحرير عرض وإعادة تنظيمه
حرر عنوان URL الخاص بملف PPTX هذا لإضافة ملخص تنفيذي جديد بعد الشريحة 2، ثم أنشئ نسخة محلية مع إزالة الشريحتين 4 و5.
أفضل الممارسات
- أكد ما إذا كانت الملفات تحتوي على بيانات سرية قبل استخدام سير عمل الرفع أو التحليل أو التحرير أو محاكاة القوالب.
- قدم عدد الشرائح والجمهور واللغة ومتطلبات النمط قبل بدء التوليد.
- استخدم عمليات الشرائح المحلية لمهام الحذف أو إعادة الترتيب أو الاستخراج أو الدمج البسيطة عندما لا تكون هناك حاجة إلى توليد عبر الواجهة الخلفية.
تجنب
- لا ترفع ملفات خاضعة للتنظيم أو سرية أو خاصة بالعملاء دون تفويض صريح.
- لا تعتمد على البحث المولد للمطالبات الحساسة للوقت دون التحقق من تواريخ المصادر.
- لا تشغل مسار المصادقة على أجهزة مشتركة دون مراجعة تخزين الرموز والتنظيف.
الأسئلة المتكررة
هل تحتاج هذه المهارة إلى حساب Skywork?
نعم. تتطلب سير عمل التوليد والتحرير والرفع والتحليل والبحث مصادقة Skywork.
هل يمكنها العمل فقط على ملفات PPTX المحلية?
نعم لمهام الحذف وإعادة الترتيب والاستخراج والدمج ومعلومات الملفات الأساسية. يستخدم التوليد والتحرير بالذكاء الاصطناعي خدمات خارجية.
هل سيتم رفع ملفاتي?
يتم رفع الملفات عند استخدام سير عمل التحليل أو محاكاة القوالب أو التحرير المستند إلى URL. لا تتطلب عمليات الشرائح المحلية الرفع إلى الواجهة الخلفية.
ما اللغات التي يمكنها التوليد بها?
تمرر سير العمل لغة المستخدم المكتشفة إلى الواجهة الخلفية، مثل الإنجليزية أو الصينية.
هل يمكنها استخدام قالب شركة?
نعم. قدم مسار قالب PPTX، وسيرفعه سير عمل المحاكاة كمرجع للنمط والتخطيط.
ما الذي يجب أن أتحقق منه قبل تثبيتها?
راجع استدعاءات API الخارجية وسلوك التخزين المؤقت للرموز والعمليات الفرعية لتشغيل المتصفح وسير عمل رفع الملفات المحلية.
تفاصيل المطور
المؤلف
SkyworkAIالترخيص
MIT
مراجعة Skillstore
r1
تنبيه الإصدار
لم يعلن المؤلف عن إصدار.
مرجع
f93e9bb0daca99badb6a7e574b97737155d57cb3
حداثة الصيانة
١٨/٧/٢٠٢٦
الاستخدام
51 تنزيلات · 140 مشاهدات
بنية الملفات
المزيد من SkyworkAI
عرض الكل📦
skywork-music-maker
38أنشئ موسيقى بالذكاء الاصطناعي باستخدام Mureka
تحويل فكرة موسيقية أولية إلى موجّه توليد قابل للاستخدام بالذكاء الاصطناعي أمر صعب. ترشدك هذه المهارة في بنية الموجّه، وكلمات الأغاني، والتوليد عبر Mureka API، ورفع المراجع، وتنزيل الصوت.
التصميم والإبداع عرض
📦
skywork-search
38البحث في الويب باستخدام Skywork
تحتاج طلبات البحث الحالية إلى مصادر تتجاوز بيانات تدريب النموذج. تستخدم هذه المهارة Skywork API للبحث في الويب وحفظ نتائج مدعومة بالمصادر.
البحث والتعلم عرض
📦
skywork-design
38إنشاء أصول مرئية باستخدام Skywork
تحتاج الفرق إلى أصول مرئية بسرعة دون إعداد تصميم يدوي. تستخدم هذه المهارة تدفقات عمل الصور في Skywork لإنشاء الصور أو تعديلها انطلاقا من مطالبات واضحة.
التصميم والإبداع عرض
📦
skywork-document
38إنشاء مستندات Skywork من الملفات
غالبًا ما تحتاج طلبات المستندات الطويلة إلى بنية واضحة وملفات مرجعية وتسليم منسق. تستخدم هذه المهارة خدمات مستندات Skywork لإنشاء ملفات مصقولة من المطالبات والمواد المرفوعة.
التوثيق عرض
مهارات ذات صلة
عرض الكل📦
pptx
85إنشاء عروض PowerPoint التقديمية باستخدام Python
بواسطة AutumnsGrove
إنشاء مجموعات شرائح PowerPoint مصقولة يدويًا بطيء ويصعب تكراره. تُرشد هذه المهارة Claude وCodex وClaude Code خلال إنشاء ملفات PPTX وتحريرها وأتمتتها باستخدام python-pptx.
المكتب والتقارير عرض
📦
ppt-orchestra-skill
78خطّط لعروض PowerPoint مصقولة
بواسطة MiniMax-AI
غالبا ما تنحرف العروض الكبيرة في البنية والأسلوب والجودة أثناء الإنشاء. تمنح هذه المهارة Claude وCodex وClaude Code خطة قابلة للتكرار لأنواع الشرائح، وقواعد التصميم، والتجميع، وQA.
المكتب والتقارير عرض
📦
when-creating-presentations-use-pptx-generation
80إنشاء عروض PowerPoint تقديمية ميسّرة الوصول
بواسطة DNYoussef
يمكن أن يكون إنتاج العروض التقديمية يدويا بطيئا وغير متسق. ترشد هذه المهارة Claude أو Codex أو Claude Code عبر إنشاء PPTX منظم والتحقق منه.
المكتب والتقارير عرض
📦
pptx-prep
78تحضير مواد العرض التقديمي قبل إنشاء PPTX
بواسطة xiaomengbi520
غالبا ما تخترع مولدات العروض التقديمية أسماء وصورا وبيانات وشعارات عندما تكون المواد المصدرية مفقودة. تتحقق هذه المهارة من المتطلبات أولا، وتجمع القرارات، وتنتج ملف بيان من أجل إنشاء PPTX بشكل أنظف.
المكتب والتقارير عرض
📦
aippt
78إنشاء عروض PowerPoint مدعومة بالذكاء الاصطناعي من القوالب
بواسطة Ceeon
إنشاء عرض تقديمي مصقول من قالب موجود يستغرق وقتًا طويلًا عندما يجب أن تحافظ كل شريحة على النمط. يرشد AIPPT المستخدمين عبر تصدير القالب، وتخطيط المحتوى، وإنشاء الشرائح بالذكاء الاصطناعي، وتغليف PPTX.
المكتب والتقارير عرض
📦
nanobanana-ppt-skills
78إنشاء عروض PowerPoint بالذكاء الاصطناعي من المستندات
بواسطة sickn33
قد يتطلب تحويل المستندات إلى عروض تقديمية واضحة تخطيطا دقيقا وتوجيها بصريا. ترشد هذه المهارة إنشاء عروض PPT بمساعدة AI من خلال تحليل المستندات وتخطيط الصور ذات الأسلوب المحدد.
المكتب والتقارير عرض