Fähigkeiten skywork-ppt
📦

skywork-ppt

Inhaltsrevision r1 Hohes Risiko 🌐 Netzwerkzugriff🔑 Umgebungsvariablen📁 Dateisystemzugriff⚙️ Externe Befehle

Skywork-PowerPoint-Decks erstellen

Aus rohen Themen, Dateien oder Vorlagen ausgefeilte Präsentationen zu erstellen, kann viele manuelle Schritte erfordern. Dieser Skill automatisiert PPTX-Erstellung, Vorlagenimitation, Bearbeitung und lokale Folienoperationen über Skywork-Workflows.

Unterstützt: Claude Codex Code(CC)
⚠️ 38 Schlecht

Mit meinem Agent installieren

Kopieren Sie diese Anfrage in Ihren Agent. Sie enthält die maßgebliche Skill-Seite und das Manifest.

Agent-Anfrage
Review the Skillstore skill "skywork-ppt" from https://skillstore.io/skills/skyworkai-skywork-ppt.md and its manifest at https://skillstore.io/api/skills/skyworkai-skywork-ppt/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Ihr Agent sollte weiterhin seinen Plan anzeigen und alle von der Sicherheitsrichtlinie verlangten Bestätigungen anfordern.

Agent-lesbare Ressourcen

Verwenden Sie diese Links, wenn ein KI-Agent, Crawler oder Skript sauberen Kontext benötigt, statt die vollständige Seite zu lesen.

Markdown-Detailseite GET /skills/skyworkai-skywork-ppt.md Signiertes manifest GET /api/skills/skyworkai-skywork-ppt/manifest Signiertes lockfile GET /api/skills/skyworkai-skywork-ppt/lockfile

Testen

„skywork-ppt“ wird verwendet. Erstelle ein englisches 6-Folien-Deck über Automatisierung im Kundensupport für ein Führungskräftemeeting.

Erwartetes Ergebnis:

Der Skill gibt einen generierten PPTX-Pfad, einen Download-Link, den Präsentationstitel und eine knappe Beschreibung Folie für Folie zurück.

„skywork-ppt“ wird verwendet. Verwende meine lokale Vorlage und erstelle eine neue Präsentation für eine Produkteinführung.

Erwartetes Ergebnis:

Der Skill lädt die Vorlage hoch, generiert eine neue PPTX in einem ähnlichen Layout und meldet, welche Vorlagendatei verwendet wurde.

„skywork-ppt“ wird verwendet. Lösche die Folien 3 und 7 aus dieser PPTX und speichere eine gekürzte Kopie.

Erwartetes Ergebnis:

Der Skill führt eine lokale Folienoperation aus und meldet den gespeicherten PPTX-Pfad mit der abgeschlossenen Änderung der Folienanzahl.

Sicherheitsaudit

Hohes Risiko
v4 • 7.7.2026 Versionsbericht öffnen

The skill has legitimate presentation-generation functionality, but it depends heavily on external Skywork APIs, local file uploads, token handling, and command execution. I confirmed the high-risk token cache, browser-launch subprocesses, document upload paths, and several filesystem risks, while dismissing Markdown backtick and placeholder URL false positives. No prompt injection attempt was found in the reviewed files.

12
Gescannte Dateien
2,255
Analysierte Zeilen
95
Prüfelemente
0
Falschmeldungen ignoriert

Bestätigte Sicherheitsbedenken (6)

Hoch
workflow_generate.md:7-10scripts/parse_file.py:41-42workflow_imitate.md:82-89scripts/upload_files.py:68-80
Third-Party Upload of Local Presentation Inputs
The workflows and scripts upload user-provided documents, templates, or PPTX files to Skywork services for parsing, storage, or generation. This is expected functionality, but it can disclose sensitive local files if the user has not given explicit approval.
The workflow text explicitly tells the agent to upload reference files or templates, and the scripts read file bytes before POSTing to Skywork endpoints.
Hoch
SKILL.md:26-29scripts/skywork_auth.py:43-44scripts/skywork_auth.py:170-173
Persistent Token Cache Without Permission Hardening
The authentication flow caches Skywork token data in ~/.skywork_token and reloads it later. The write path does not apply restrictive permissions or use an operating system credential store.
The token cache path and JSON write are direct, and I found no chmod, keychain, or permission check around the stored credential.
Hoch
scripts/web_search.py:67-72
Query-Controlled Search Result File Path
The web search script builds an output filename from the raw query string before writing search results. A crafted query containing path separators or an absolute path can influence where the result file is written.
The query comes from CLI arguments, is concatenated into the filename, and is passed to open() without sanitization or basename normalization.
Niedrig
SKILL.md:29
System reconnaissance
3. No valid token → opens browser for login, polls until complete, saves token
The instructions state that the login flow opens a browser, polls for completion, and saves a token. This is security relevant authentication behavior.
Niedrig
SKILL.md:48
System reconnaissance
**This skill requires Python 3 (>=3.8). Run the following before any script to locate a valid Python
The instructions enumerate candidate Python binaries with command -v and test versions. This is limited host inspection for dependency setup.
Niedrig
workflow_generate.md:85
System reconnaissance
After writing the reference report, save it to a local temp file to avoid shell encoding issues:
The workflow instructs saving a reference report to a temp file. It is not reconnaissance, but it is still filesystem behavior with potentially sensitive content.
Elemente der Fähigkeitsprüfung (95)

Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.

Hoch
scripts/skywork_auth.py:87
Python subprocess.Popen
subprocess.Popen(["open", url], start_new_session=True,
The authentication flow spawns OS commands to open a browser, and the Windows branch uses shell=True. The commands are fixed, but launching external processes from a skill is a real execution risk.
Hoch
scripts/skywork_auth.py:90
Python subprocess.Popen
subprocess.Popen(["start", url], shell=True, start_new_session=True,
The authentication flow spawns OS commands to open a browser, and the Windows branch uses shell=True. The commands are fixed, but launching external processes from a skill is a real execution risk.
Hoch
scripts/skywork_auth.py:93
Python subprocess.Popen
subprocess.Popen(["xdg-open", url], start_new_session=True,
The authentication flow spawns OS commands to open a browser, and the Windows branch uses shell=True. The commands are fixed, but launching external processes from a skill is a real execution risk.
Hoch
scripts/skywork_auth.py:6
Hidden file in home directory
Token is stored in user home directory as ~/.skywork_token (JSON format).
The skill stores or documents a persistent Skywork token in ~/.skywork_token in the user home directory. A cached bearer token can be reused by other local processes or users if permissions are weak.
Hoch
scripts/skywork_auth.py:44
Hidden file in home directory
TOKEN_FILE = os.path.expanduser("~/.skywork_token")
The skill stores or documents a persistent Skywork token in ~/.skywork_token in the user home directory. A cached bearer token can be reused by other local processes or users if permissions are weak.
Hoch
scripts/skywork_auth.py:6
Hidden file access
Token is stored in user home directory as ~/.skywork_token (JSON format).
The skill stores or documents a persistent Skywork token in ~/.skywork_token in the user home directory. A cached bearer token can be reused by other local processes or users if permissions are weak.
Hoch
scripts/skywork_auth.py:44
Hidden file access
TOKEN_FILE = os.path.expanduser("~/.skywork_token")
The skill stores or documents a persistent Skywork token in ~/.skywork_token in the user home directory. A cached bearer token can be reused by other local processes or users if permissions are weak.
Hoch
scripts/skywork_auth.py:172
Python file write/append
with open(TOKEN_FILE, "w", encoding="utf-8") as f:
The script writes token data to the persistent ~/.skywork_token cache. The code does not set restrictive file permissions around the credential write.
Hoch
scripts/upload_files.py:15
Python HTTP libraries
import urllib.request
The script reads local files and uploads their full bytes to Skywork object storage through the gateway. This is a direct exfiltration surface for sensitive files if invoked without clear consent.
Hoch
scripts/upload_files.py:81
Python HTTP libraries
req = urllib.request.Request(
The script reads local files and uploads their full bytes to Skywork object storage through the gateway. This is a direct exfiltration surface for sensitive files if invoked without clear consent.
Hoch
scripts/upload_files.py:91
Python HTTP libraries
with urllib.request.urlopen(req, timeout=60) as resp:
The script reads local files and uploads their full bytes to Skywork object storage through the gateway. This is a direct exfiltration surface for sensitive files if invoked without clear consent.
Hoch
scripts/web_search.py:71
Python file write/append
with open(out_path, "w", encoding="utf-8") as f:
The script writes search results to a filename derived from the raw query string. A crafted query can influence the output path and leave sensitive search context on disk.
Hoch
SKILL.md:28
Hidden file in home directory
2. Cached token file `~/.skywork_token` → validate via API, if valid, use it
The instructions explicitly use a cached ~/.skywork_token credential file. Persistent hidden-token storage is a real credential exposure risk.
Hoch
SKILL.md:28
Hidden file access
2. Cached token file `~/.skywork_token` → validate via API, if valid, use it
The instructions explicitly use a cached ~/.skywork_token credential file. Persistent hidden-token storage is a real credential exposure risk.
Mittel
scripts/parse_file.py:24
Python HTTP libraries
from urllib.request import Request, urlopen
The script uploads user-provided files to the Skywork Office parse service and streams results back. This is a real external data transfer risk for sensitive documents.
Mittel
scripts/parse_file.py:12
Hardcoded URL
SKYWORK_OFFICE_URL - Base URL (default: https://api-tools.skywork.ai/theme-gateway)
The script uploads user-provided files to the Skywork Office parse service and streams results back. This is a real external data transfer risk for sensitive documents.
Mittel
scripts/parse_file.py:157
Python file write/append
with open(args.output, "w", encoding="utf-8") as f:
The optional output path writes parsed document content to disk. A user-controlled path can overwrite writable files or leave sensitive extracted text behind.
Mittel
scripts/run_ppt_write.py:16
Python HTTP libraries
import urllib.request
The script sends prompts, references, uploaded file metadata, and tokens to Skywork generation or edit APIs, then downloads the PPTX result. This is intentional but security relevant network transfer.
Mittel
scripts/run_ppt_write.py:296
Python HTTP libraries
req = urllib.request.Request(
The script sends prompts, references, uploaded file metadata, and tokens to Skywork generation or edit APIs, then downloads the PPTX result. This is intentional but security relevant network transfer.
Mittel
scripts/run_ppt_write.py:305
Python HTTP libraries
with urllib.request.urlopen(req, timeout=600) as resp:
The script sends prompts, references, uploaded file metadata, and tokens to Skywork generation or edit APIs, then downloads the PPTX result. This is intentional but security relevant network transfer.
Mittel
scripts/run_ppt_write.py:328
Python HTTP libraries
req2 = urllib.request.Request(download_url, method="GET")
The script sends prompts, references, uploaded file metadata, and tokens to Skywork generation or edit APIs, then downloads the PPTX result. This is intentional but security relevant network transfer.
Mittel
scripts/run_ppt_write.py:329
Python HTTP libraries
with urllib.request.urlopen(req2, timeout=120) as r:
The script sends prompts, references, uploaded file metadata, and tokens to Skywork generation or edit APIs, then downloads the PPTX result. This is intentional but security relevant network transfer.
Mittel
scripts/run_ppt_write.py:244
Temp directory access
log_file = f"/tmp/ppt_run_{session_id}.log" if args.log_path == "" else args.log_path
The script creates or appends log files and writes the generated PPTX to a caller-controlled output path. This can expose content in logs or overwrite writable files if paths are unsafe.
Mittel
scripts/run_ppt_write.py:34
Python file write/append
with open(log_file, "a", encoding="utf-8") as f:
The script creates or appends log files and writes the generated PPTX to a caller-controlled output path. This can expose content in logs or overwrite writable files if paths are unsafe.
Mittel
scripts/run_ppt_write.py:245
Python file write/append
open(log_file, "w").close() # clear previous run
The script creates or appends log files and writes the generated PPTX to a caller-controlled output path. This can expose content in logs or overwrite writable files if paths are unsafe.
Mittel
scripts/run_ppt_write.py:330
Python file write/append
with open(out_abs, "wb") as f:
The script creates or appends log files and writes the generated PPTX to a caller-controlled output path. This can expose content in logs or overwrite writable files if paths are unsafe.
Mittel
scripts/skywork_auth.py:41
Hardcoded URL
API_BASE = os.environ.get("SKYWORK_API_BASE", "https://api.skywork.ai")
The authentication module contacts Skywork login and token validation endpoints. This sends authentication state to an external service and is security relevant.
Mittel
scripts/skywork_auth.py:42
Hardcoded URL
LOGIN_BASE_URL = os.environ.get("SKYWORK_WEB_BASE", "https://skywork.ai")
The authentication module contacts Skywork login and token validation endpoints. This sends authentication state to an external service and is security relevant.
Mittel
scripts/skywork_auth.py:41
Python environment access
API_BASE = os.environ.get("SKYWORK_API_BASE", "https://api.skywork.ai")
The API and web login bases are environment-overridable. This can redirect authentication traffic if the environment is not trusted.
Mittel
scripts/skywork_auth.py:42
Python environment access
LOGIN_BASE_URL = os.environ.get("SKYWORK_WEB_BASE", "https://skywork.ai")
The API and web login bases are environment-overridable. This can redirect authentication traffic if the environment is not trusted.
Mittel
scripts/skywork_auth.py:223
Python environment access
env_token = os.environ.get("SKYBOT_TOKEN", "")
The script reads SKYBOT_TOKEN from the environment and uses it as an authentication token. Environment-sourced credentials are sensitive and later authorize network calls.
Mittel
scripts/skywork_auth.py:288
Python environment access
env_token = os.environ.get("SKYBOT_TOKEN", "")
The script reads SKYBOT_TOKEN from the environment and uses it as an authentication token. Environment-sourced credentials are sensitive and later authorize network calls.
Mittel
scripts/web_search.py:14
Python HTTP libraries
import urllib.request
The script sends search queries to a Skywork web search API with an authentication token. Queries can contain sensitive project or business context.
Mittel
scripts/web_search.py:24
Python HTTP libraries
req = urllib.request.Request(
The script sends search queries to a Skywork web search API with an authentication token. Queries can contain sensitive project or business context.
Mittel
scripts/web_search.py:31
Python HTTP libraries
with urllib.request.urlopen(req, timeout=30) as resp:
The script sends search queries to a Skywork web search API with an authentication token. Queries can contain sensitive project or business context.
Mittel
scripts/web_search.py:13
Temp file creation
import tempfile
The script creates a temporary directory for search result files. Temporary storage is legitimate but can retain sensitive query results after the run.
Mittel
scripts/web_search.py:60
Temp file creation
out_dir = tempfile.mkdtemp(prefix="web_search_")
The script creates a temporary directory for search result files. Temporary storage is legitimate but can retain sensitive query results after the run.
Mittel
SKILL.md:21-24
Ruby/shell backtick execution
```bash
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
Mittel
SKILL.md:24-27
Ruby/shell backtick execution
```
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
Mittel
SKILL.md:27-28
Ruby/shell backtick execution
1. Environment variable `SKYBOT_TOKEN` → if set, use directly
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
Mittel
SKILL.md:28-31
Ruby/shell backtick execution
2. Cached token file `~/.skywork_token` → validate via API, if valid, use it
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
Mittel
SKILL.md:31-50
Ruby/shell backtick execution
**IMPORTANT - Login URL handling**: If script output contains a line starting with `[LOGIN_URL]`, yo
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
Mittel
SKILL.md:50-69
Ruby/shell backtick execution
```bash
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
Mittel
SKILL.md:69-71
Ruby/shell backtick execution
```
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
Mittel
SKILL.md:71
Ruby/shell backtick execution
> After this check, replace `python` with the discovered `$PYTHON_CMD` (e.g. `python3`) in all subse
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
Mittel
SKILL.md:78-79
Ruby/shell backtick execution
0. **REQUIRED FIRST STEP** — Read [workflow_generate.md](workflow_generate.md) NOW, before taking an
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
Mittel
SKILL.md:79-80
Ruby/shell backtick execution
1. **Environment check** — run the check above to get `$PYTHON_CMD`.
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
Mittel
SKILL.md:80
Ruby/shell backtick execution
2. **Upload reference files** (if the user provides local files as content source) — parse the file
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
Mittel
SKILL.md:81-83
Ruby/shell backtick execution
3. **Web search** (required if no relevant content is already in the conversation) — call web_search
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
Mittel
SKILL.md:83
Ruby/shell backtick execution
> **Important**: set exec tool `yieldMs` to `600000` (10 minutes).
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
Mittel
SKILL.md:84-92
Ruby/shell backtick execution
5. **Deliver** — provide the absolute `.pptx` path and the download URL.
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
Mittel
SKILL.md:92-93
Ruby/shell backtick execution
1. **Environment check** — run the check above to get `$PYTHON_CMD`.
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
Mittel
SKILL.md:93-94
Ruby/shell backtick execution
2. **Locate the template** — extract the absolute path of the local `.pptx` from the user's message;
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
Mittel
SKILL.md:94-95
Ruby/shell backtick execution
3. **Upload the template** — upload it and extract `TEMPLATE_URL` from the output.
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
Mittel
SKILL.md:95
Ruby/shell backtick execution
4. **Upload reference files** (if the user provides additional local files as content source) — pars
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
Mittel
SKILL.md:96-98
Ruby/shell backtick execution
5. **Web search** (required if no relevant content is already in the conversation) — call web_search
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
Mittel
SKILL.md:98
Ruby/shell backtick execution
> **Important**: set exec tool `yieldMs` to `600000` (10 minutes).
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
Mittel
SKILL.md:99-109
Ruby/shell backtick execution
7. **Deliver** — provide the absolute `.pptx` path, the download URL, and the template filename used
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
Mittel
SKILL.md:109-111
Ruby/shell backtick execution
1. **Environment check** — run the check above to get `$PYTHON_CMD`.
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
Mittel
SKILL.md:111-112
Ruby/shell backtick execution
3. **Run the script** with `--pptx-url`:
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
Mittel
SKILL.md:112-117
Ruby/shell backtick execution
```bash
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
Mittel
SKILL.md:117-118
Ruby/shell backtick execution
```
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
Mittel
SKILL.md:118
Ruby/shell backtick execution
> **Important**: set exec tool `yieldMs` to `600000` (10 minutes).
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
Mittel
SKILL.md:125-140
Ruby/shell backtick execution
```bash
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
Mittel
SKILL.md:140-148
Ruby/shell backtick execution
```
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
Mittel
SKILL.md:148-155
Ruby/shell backtick execution
- **Insufficient benefit**: When calling scripts (generate, imitate, or edit), the script or log may
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
Mittel
SKILL.md:155-156
Ruby/shell backtick execution
- **Format**: One short sentence in the user's language + a link like `[Upgrade now →](url)` or the
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
Mittel
SKILL.md:156-162
Ruby/shell backtick execution
- **URL**: Extract the upgrade URL from the log/script output (e.g. the `at https://...` part).
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
Mittel
SKILL.md:162
Ruby/shell backtick execution
- **Python 3.8+** (required) — `python3` / `python` must be on PATH
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
Mittel
SKILL.md:65
Shell command substitution
echo "Found Python: $PYTHON_CMD ($($PYTHON_CMD --version))"
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
Mittel
SKILL.md:50-69
Template literal with command substitution
```bash
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
Mittel
workflow_edit.md:45
Shell command substitution
PPT_LOG=/tmp/ppt_$(date +%s).log
The workflow instructs shell command substitution while running and monitoring background PPT jobs. It is expected process control, but it requires local command execution.
Mittel
workflow_edit.md:71
Shell command substitution
PPT_PID=$(grep '^\[PID\]' "$PPT_LOG" | tail -1 | awk '{print $2}')
The workflow instructs shell command substitution while running and monitoring background PPT jobs. It is expected process control, but it requires local command execution.
Mittel
workflow_edit.md:45
Temp directory access
PPT_LOG=/tmp/ppt_$(date +%s).log
The workflow creates a predictable timestamp-based log file under /tmp. Logs may contain PPT progress or error details and can persist after execution.
Mittel
workflow_generate.md:128
Shell command substitution
PPT_LOG=/tmp/ppt_$(date +%s).log
The workflow instructs shell command substitution while running and monitoring background PPT jobs. It is expected process control, but it requires local command execution.
Mittel
workflow_generate.md:154
Shell command substitution
PPT_PID=$(grep '^\[PID\]' "$PPT_LOG" | tail -1 | awk '{print $2}')
The workflow instructs shell command substitution while running and monitoring background PPT jobs. It is expected process control, but it requires local command execution.
Mittel
workflow_generate.md:87
Temp directory access
cat > /tmp/ppt_reference.md << 'REFERENCE_EOF'
The workflow writes reference material and logs under /tmp using predictable names. These files can contain sensitive source content or generation details.
Mittel
workflow_generate.md:117
Temp directory access
- **--reference-file** (optional): Pass the path to the temp file written at the end of Step 2 (e.g.
The workflow writes reference material and logs under /tmp using predictable names. These files can contain sensitive source content or generation details.
Mittel
workflow_generate.md:128
Temp directory access
PPT_LOG=/tmp/ppt_$(date +%s).log
The workflow writes reference material and logs under /tmp using predictable names. These files can contain sensitive source content or generation details.
Mittel
workflow_generate.md:132
Temp directory access
--reference-file /tmp/ppt_reference.md \
The workflow writes reference material and logs under /tmp using predictable names. These files can contain sensitive source content or generation details.
Mittel
workflow_imitate.md:111
Shell command substitution
PPT_LOG=/tmp/ppt_$(date +%s).log
The workflow instructs shell command substitution while running and monitoring background PPT jobs. It is expected process control, but it requires local command execution.
Mittel
workflow_imitate.md:139
Shell command substitution
PPT_PID=$(grep '^\[PID\]' "$PPT_LOG" | tail -1 | awk '{print $2}')
The workflow instructs shell command substitution while running and monitoring background PPT jobs. It is expected process control, but it requires local command execution.
Mittel
workflow_imitate.md:74
Temp directory access
cat > /tmp/ppt_reference.md << 'REFERENCE_EOF'
The workflow writes reference material, uses /tmp paths, or documents template paths. Temporary files and local paths can expose sensitive presentation content.
Mittel
workflow_imitate.md:100
Temp directory access
- **--reference-file** (optional): Path to the temp file written at the end of Step 3 (e.g. `/tmp/pp
The workflow writes reference material, uses /tmp paths, or documents template paths. Temporary files and local paths can expose sensitive presentation content.
Mittel
workflow_imitate.md:111
Temp directory access
PPT_LOG=/tmp/ppt_$(date +%s).log
The workflow writes reference material, uses /tmp paths, or documents template paths. Temporary files and local paths can expose sensitive presentation content.
Mittel
workflow_imitate.md:116
Temp directory access
--reference-file /tmp/ppt_reference.md \
The workflow writes reference material, uses /tmp paths, or documents template paths. Temporary files and local paths can expose sensitive presentation content.
Mittel
workflow_imitate.md:187
Temp directory access
| Use this template to make a PPT on AI trends — template at `/tmp/style.pptx` | ✅ Imitate |
The workflow writes reference material, uses /tmp paths, or documents template paths. Temporary files and local paths can expose sensitive presentation content.
Niedrig
scripts/config.py:9
Hardcoded URL
SKYWORK_AUTH_API_BASE = "https://api.skywork.ai"
This config defines external Skywork API endpoints that the skill uses for authentication, parsing, upload, search, and PPT generation. Network destinations are expected but still require disclosure and trust in a third-party service.
Niedrig
scripts/config.py:12
Hardcoded URL
SKYWORK_WEB_BASE = "https://skywork.ai"
This config defines external Skywork API endpoints that the skill uses for authentication, parsing, upload, search, and PPT generation. Network destinations are expected but still require disclosure and trust in a third-party service.
Niedrig
scripts/config.py:16
Hardcoded URL
SKYWORK_OFFICE_URL = os.environ.get("SKYWORK_OFFICE_URL", "https://api.skywork.ai/skywork-office-rou
This config defines external Skywork API endpoints that the skill uses for authentication, parsing, upload, search, and PPT generation. Network destinations are expected but still require disclosure and trust in a third-party service.
Niedrig
scripts/config.py:19
Hardcoded URL
SKYWORK_GATEWAY_URL = os.environ.get("SKYWORK_GATEWAY_URL", "https://api-tools.skywork.ai/theme-gate
This config defines external Skywork API endpoints that the skill uses for authentication, parsing, upload, search, and PPT generation. Network destinations are expected but still require disclosure and trust in a third-party service.
Niedrig
scripts/config.py:16
Python environment access
SKYWORK_OFFICE_URL = os.environ.get("SKYWORK_OFFICE_URL", "https://api.skywork.ai/skywork-office-rou
The service base URL can be overridden from the environment. That is useful for deployment but can redirect uploads or tokens if the execution environment is compromised.
Niedrig
scripts/config.py:19
Python environment access
SKYWORK_GATEWAY_URL = os.environ.get("SKYWORK_GATEWAY_URL", "https://api-tools.skywork.ai/theme-gate
The service base URL can be overridden from the environment. That is useful for deployment but can redirect uploads or tokens if the execution environment is compromised.
Niedrig
scripts/run_ppt_write.py:282
Python environment access
payload["source_platform"] = "skyclaw" if os.environ.get("POD_TYPE", "") == "skyclaw" else ""
The script reads POD_TYPE from the environment to set source_platform. The value is low sensitivity but confirms environment-dependent behavior.
Niedrig
scripts/web_search.py:22
Python environment access
payload = {"query": query, "source_platform": "skyclaw" if os.environ.get("POD_TYPE", "") == "skycla
The script reads POD_TYPE from the environment to set source_platform. This is low sensitivity but confirms environment-dependent behavior.

Risikofaktoren

🌐 Netzwerkzugriff (34)
scripts/config.py:9 scripts/config.py:12 scripts/config.py:16 scripts/config.py:19 scripts/local_pptx_ops.py:91 scripts/parse_file.py:24 scripts/parse_file.py:12 scripts/run_ppt_write.py:16 scripts/run_ppt_write.py:296 scripts/run_ppt_write.py:305 scripts/run_ppt_write.py:328 scripts/run_ppt_write.py:329 scripts/run_ppt_write.py:231 scripts/skywork_auth.py:41 scripts/skywork_auth.py:42 scripts/upload_files.py:15 scripts/upload_files.py:81 scripts/upload_files.py:91 scripts/upload_files.py:106 scripts/web_search.py:14 scripts/web_search.py:24 scripts/web_search.py:31 SKILL.md:61 SKILL.md:115 SKILL.md:156 workflow_edit.md:49 workflow_generate.md:21 workflow_generate.md:27 workflow_generate.md:28 workflow_generate.md:133 workflow_imitate.md:46 workflow_imitate.md:52 workflow_imitate.md:53 workflow_imitate.md:117
🔑 Umgebungsvariablen (8)
scripts/config.py:16 scripts/config.py:19 scripts/run_ppt_write.py:282 scripts/skywork_auth.py:41 scripts/skywork_auth.py:42 scripts/skywork_auth.py:223 scripts/skywork_auth.py:288 scripts/web_search.py:22
📁 Dateisystemzugriff (33)
scripts/parse_file.py:157 scripts/run_ppt_write.py:244 scripts/run_ppt_write.py:34 scripts/run_ppt_write.py:245 scripts/run_ppt_write.py:330 scripts/skywork_auth.py:6 scripts/skywork_auth.py:44 scripts/skywork_auth.py:6 scripts/skywork_auth.py:44 scripts/skywork_auth.py:172 scripts/upload_files.py:106 scripts/web_search.py:13 scripts/web_search.py:60 scripts/web_search.py:71 SKILL.md:28 SKILL.md:28 SKILL.md:53 workflow_edit.md:52 workflow_edit.md:73 workflow_edit.md:45 workflow_generate.md:136 workflow_generate.md:156 workflow_generate.md:87 workflow_generate.md:117 workflow_generate.md:128 workflow_generate.md:132 workflow_imitate.md:120 workflow_imitate.md:141 workflow_imitate.md:74 workflow_imitate.md:100 workflow_imitate.md:111 workflow_imitate.md:116 workflow_imitate.md:187
⚙️ Externe Befehle (43)
scripts/skywork_auth.py:87 scripts/skywork_auth.py:90 scripts/skywork_auth.py:93 SKILL.md:21-24 SKILL.md:24-27 SKILL.md:27-28 SKILL.md:28-31 SKILL.md:31-50 SKILL.md:50-69 SKILL.md:69-71 SKILL.md:71 SKILL.md:78-79 SKILL.md:79-80 SKILL.md:80 SKILL.md:81-83 SKILL.md:83 SKILL.md:84-92 SKILL.md:92-93 SKILL.md:93-94 SKILL.md:94-95 SKILL.md:95 SKILL.md:96-98 SKILL.md:98 SKILL.md:99-109 SKILL.md:109-111 SKILL.md:111-112 SKILL.md:112-117 SKILL.md:117-118 SKILL.md:118 SKILL.md:125-140 SKILL.md:140-148 SKILL.md:148-155 SKILL.md:155-156 SKILL.md:156-162 SKILL.md:162 SKILL.md:65 SKILL.md:50-69 workflow_edit.md:45 workflow_edit.md:71 workflow_generate.md:128 workflow_generate.md:154 workflow_imitate.md:111 workflow_imitate.md:139

Erkannte Muster

System reconnaissance×3
Geprüft von: codex Audit-Verlauf anzeigen →
Diesen Bericht teilen & zitieren

Teile den versionierten Bewertungsbericht, das neutrale Badge, die Einbettungskarte und Zitate. Skillstore berichtet Nachweise, ohne zu entscheiden, ob dieser Skill sicher ist.

Versionsbericht öffnen
Sicherheitsbewertung

Berichtslink kopieren

https://skillstore.io/skills/skyworkai-skywork-ppt/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown-Badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/skyworkai-skywork-ppt/security.svg)](https://skillstore.io/skills/skyworkai-skywork-ppt?utm_source=security_passport_badge)

HTML-Badge

<a href="https://skillstore.io/skills/skyworkai-skywork-ppt?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/skyworkai-skywork-ppt/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Einbettungskarte

<iframe src="https://skillstore.io/embed/skills/skyworkai-skywork-ppt.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Wissenschaftliche Zitate (APA · BibTeX · CFF)

APA-Zitat

SkyworkAI. (2026). skywork-ppt security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/skyworkai-skywork-ppt/audits/4

BibTeX-Zitat

@techreport{skyworkai-skyworkai-skywork-ppt-2026, author = {SkyworkAI}, title = {skywork-ppt security audit report (audit version 4)}, institution = {Skillstore}, year = {2026}, number = {4}, url = {https://skillstore.io/skills/skyworkai-skywork-ppt/audits/4}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "skywork-ppt security audit report (audit version 4)" version: "unspecified" type: report authors: - name: "SkyworkAI" date-released: "2026-07-07" url: "https://skillstore.io/skills/skyworkai-skywork-ppt/audits/4" identifiers: - type: other value: "skillstore:skyworkai-skywork-ppt:audit:4" description: "Skillstore immutable audit report identifier"

Skillstore-Score

Warum dieser Score Evidenzvertrauen: Mittel
45
Architektur
85
Wartbarkeit
87
Inhalt
69
Gemeinschaft
83
Spezifikationskonformität

Was Sie erstellen können

Ein Briefing-Deck aus einem Thema erstellen

Ein Thema, eine Zielgruppe, eine Folienanzahl und unterstützende Notizen in eine generierte PPTX mit Fortschrittsprotokollen und Download-Link umwandeln.

Einen Unternehmenspräsentationsstil wiederverwenden

Eine PPTX-Vorlage hochladen und ein neues Deck erstellen, das dem Vorlagenlayout und der visuellen Struktur folgt.

Eine vorhandene Foliendatei bereinigen

Folien lokal prüfen, löschen, neu anordnen, extrahieren oder zusammenführen, ohne das Deck an das Generierungs-Backend zu senden.

Diese Prompts ausprobieren

Ein einfaches Deck erstellen 
Erstelle eine englische PPTX über Trends bei erneuerbaren Energien für eine allgemeine Business-Zielgruppe. Verwende 8 Folien und einen klaren professionellen Stil.
Aus Referenzdateien erstellen 
Erstelle aus dem angehängten Marktbericht ein 10-Folien-Investorenbriefing. Übernimm wichtige Zahlen, Daten und Unternehmensnamen exakt.
Einen Vorlagenstil imitieren 
Verwende die PPTX-Vorlage unter diesem lokalen Pfad und erstelle ein 12-Folien-Deck über unsere Produkt-Roadmap 2026. Passe dich der Vorlagenstruktur an.
Ein Deck bearbeiten und neu organisieren 
Bearbeite diese PPTX-URL, um nach Folie 2 eine neue Executive Summary hinzuzufügen, und erstelle anschließend eine lokale Kopie, aus der die Folien 4 und 5 entfernt wurden.

Bewährte Praktiken

  • Bestätige vor der Verwendung von Upload-, Analyse-, Bearbeitungs- oder Vorlagenimitations-Workflows, ob Dateien vertrauliche Daten enthalten.
  • Gib Folienanzahl, Zielgruppe, Sprache und Stilanforderungen an, bevor die Erstellung startet.
  • Verwende lokale Folienoperationen für einfache Aufgaben zum Löschen, Neuordnen, Extrahieren oder Zusammenführen, wenn keine Backend-Generierung nötig ist.

Vermeiden

  • Lade keine regulierten, geheimen oder kundenvertraulichen Dateien ohne ausdrückliche Autorisierung hoch.
  • Verlasse dich bei zeitkritischen Behauptungen nicht auf generierte Recherchen, ohne die Quelldaten zu prüfen.
  • Führe den Authentifizierungsablauf auf gemeinsam genutzten Maschinen nicht aus, ohne Token-Speicherung und Bereinigung zu prüfen.

Häufig gestellte Fragen

Benötigt dieser Skill ein Skywork-Konto?
Ja. Die Workflows für Erstellung, Bearbeitung, Upload, Analyse und Suche erfordern Skywork-Authentifizierung.
Kann er nur mit lokalen PPTX-Dateien arbeiten?
Ja, für Löschen, Neuordnen, Extrahieren, Zusammenführen und einfache Dateiinformationsaufgaben. Erstellung und KI-Bearbeitung nutzen externe Dienste.
Werden meine Dateien hochgeladen?
Dateien werden hochgeladen, wenn Analyse-, Vorlagenimitations- oder URL-basierte Bearbeitungs-Workflows verwendet werden. Lokale Folienoperationen erfordern keinen Backend-Upload.
Welche Sprachen kann er generieren?
Die Workflows übergeben die erkannte Benutzersprache an das Backend, beispielsweise Englisch oder Chinesisch.
Kann er eine Unternehmensvorlage verwenden?
Ja. Gib einen PPTX-Vorlagenpfad an, und der Imitations-Workflow lädt ihn als Stil- und Layoutreferenz hoch.
Was sollte ich vor der Installation prüfen?
Prüfe die externen API-Aufrufe, das Verhalten des Token-Caches, Browser-Start-Subprozesse und Workflows zum Hochladen lokaler Dateien.

Entwicklerdetails

Autor

SkyworkAI

Lizenz

MIT

Skillstore-Revision

r1

Versionshinweis

Der Autor hat keine Version angegeben.

Repository

https://github.com/SkyworkAI/Skywork-Skills/tree/main/skywork-ppt

Ref.

f93e9bb0daca99badb6a7e574b97737155d57cb3

Aktualität der Wartung

18.7.2026

Nutzung

51 Downloads · 140 Aufrufe

Dateistruktur

📁 scripts/

📄 config.py

📄 local_pptx_ops.py

📄 parse_file.py

📄 run_ppt_write.py

📄 skywork_auth.py

📄 upload_files.py

📄 web_search.py

📄 SKILL.md

📄 workflow_edit.md

📄 workflow_generate.md

📄 workflow_imitate.md

📄 workflow_local.md

Mehr von SkyworkAI

Alle anzeigen

Ähnliche Skills

Alle anzeigen