📦
skywork-excel
38SkyworkでExcelレポートを作成
スプレッドシート作業では、多くの場合、数式、グラフ、ファイル変換、丁寧な書式設定が必要です。このスキルは、ExcelファイルまたはHTMLレポートを生成するために、タスクをSkywork Excel Agentに送信します。
オフィス＆レポート 表示
スキル skywork-ppt
📦
skywork-ppt
コンテンツリビジョン r1 高リスク 🌐 ネットワークアクセス🔑 環境変数📁 ファイルシステムへのアクセス⚙️ 外部コマンド
Skywork PowerPoint デッキを作成
未整理のトピック、ファイル、テンプレートから洗練されたプレゼンテーションを作成するには、多くの手作業が必要になることがあります。このスキルは、Skywork ワークフローを通じて PPTX 生成、テンプレート模倣、編集、ローカルでのスライド操作を自動化します。
対応: Claude Codex Code(CC)
インストール前に停止して確認を求めてください。
計画を確認し、ファイルを変更する前にユーザーの明示的な同意を得てください。
自分のエージェントでインストール
このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。
エージェントリクエスト
Review the Skillstore skill "skywork-ppt" from https://skillstore.io/skills/skyworkai-skywork-ppt.md and its manifest at https://skillstore.io/api/skills/skyworkai-skywork-ppt/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。
エージェントが読めるリソース
AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。
テストする
「skywork-ppt」を使用しています。 リーダーシップ会議向けに、カスタマーサポート自動化についての 6 枚のスライドの英語デッキを作成してください。
期待される結果:
このスキルは、生成された PPTX パス、ダウンロードリンク、プレゼンテーションタイトル、簡潔なスライドごとの説明を返します。
「skywork-ppt」を使用しています。 私のローカルテンプレートを使用して、新しい製品発表プレゼンテーションを作成してください。
期待される結果:
このスキルはテンプレートをアップロードし、類似したレイアウトで新しい PPTX を生成し、使用されたテンプレートファイルを報告します。
「skywork-ppt」を使用しています。 この PPTX からスライド 3 と 7 を削除し、短縮版のコピーを保存してください。
期待される結果:
このスキルはローカルスライド操作を実行し、保存された PPTX パスと完了後のスライド数の変更を報告します。
セキュリティ監査
高リスクv4 • 2026/7/7 バージョン別レポートを開く
The skill has legitimate presentation-generation functionality, but it depends heavily on external Skywork APIs, local file uploads, token handling, and command execution. I confirmed the high-risk token cache, browser-launch subprocesses, document upload paths, and several filesystem risks, while dismissing Markdown backtick and placeholder URL false positives. No prompt injection attempt was found in the reviewed files.
12
スキャンされたファイル
2,255
解析済み行数
95
レビュー項目
0
誤検知を無視
確認済みのセキュリティ上の懸念 (6)
高
workflow_generate.md:7-10scripts/parse_file.py:41-42workflow_imitate.md:82-89scripts/upload_files.py:68-80
Third-Party Upload of Local Presentation Inputs
The workflows and scripts upload user-provided documents, templates, or PPTX files to Skywork services for parsing, storage, or generation. This is expected functionality, but it can disclose sensitive local files if the user has not given explicit approval.
The workflow text explicitly tells the agent to upload reference files or templates, and the scripts read file bytes before POSTing to Skywork endpoints.
高
Persistent Token Cache Without Permission Hardening
The authentication flow caches Skywork token data in ~/.skywork_token and reloads it later. The write path does not apply restrictive permissions or use an operating system credential store.
The token cache path and JSON write are direct, and I found no chmod, keychain, or permission check around the stored credential.
高
Query-Controlled Search Result File Path
The web search script builds an output filename from the raw query string before writing search results. A crafted query containing path separators or an absolute path can influence where the result file is written.
The query comes from CLI arguments, is concatenated into the filename, and is passed to open() without sanitization or basename normalization.
低
System reconnaissance
3. No valid token → opens browser for login, polls until complete, saves token
The instructions state that the login flow opens a browser, polls for completion, and saves a token. This is security relevant authentication behavior.
低
System reconnaissance
**This skill requires Python 3 (>=3.8). Run the following before any script to locate a valid Python
The instructions enumerate candidate Python binaries with command -v and test versions. This is limited host inspection for dependency setup.
低
System reconnaissance
After writing the reference report, save it to a local temp file to avoid shell encoding issues:
The workflow instructs saving a reference report to a temp file. It is not reconnaissance, but it is still filesystem behavior with potentially sensitive content.
機能レビュー項目 (95)
これらは、このスキルに期待される可能性のある実際のローカル機能であるため、レビューが必要ですが、確認済みの悪意ある動作としてはカウントされません。
高
Python subprocess.Popen
subprocess.Popen(["open", url], start_new_session=True,
The authentication flow spawns OS commands to open a browser, and the Windows branch uses shell=True. The commands are fixed, but launching external processes from a skill is a real execution risk.
高
Python subprocess.Popen
subprocess.Popen(["start", url], shell=True, start_new_session=True,
The authentication flow spawns OS commands to open a browser, and the Windows branch uses shell=True. The commands are fixed, but launching external processes from a skill is a real execution risk.
高
Python subprocess.Popen
subprocess.Popen(["xdg-open", url], start_new_session=True,
The authentication flow spawns OS commands to open a browser, and the Windows branch uses shell=True. The commands are fixed, but launching external processes from a skill is a real execution risk.
高
Hidden file in home directory
Token is stored in user home directory as ~/.skywork_token (JSON format).
The skill stores or documents a persistent Skywork token in ~/.skywork_token in the user home directory. A cached bearer token can be reused by other local processes or users if permissions are weak.
高
Hidden file in home directory
TOKEN_FILE = os.path.expanduser("~/.skywork_token")
The skill stores or documents a persistent Skywork token in ~/.skywork_token in the user home directory. A cached bearer token can be reused by other local processes or users if permissions are weak.
高
Hidden file access
Token is stored in user home directory as ~/.skywork_token (JSON format).
The skill stores or documents a persistent Skywork token in ~/.skywork_token in the user home directory. A cached bearer token can be reused by other local processes or users if permissions are weak.
高
Hidden file access
TOKEN_FILE = os.path.expanduser("~/.skywork_token")
The skill stores or documents a persistent Skywork token in ~/.skywork_token in the user home directory. A cached bearer token can be reused by other local processes or users if permissions are weak.
高
Python file write/append
with open(TOKEN_FILE, "w", encoding="utf-8") as f:
The script writes token data to the persistent ~/.skywork_token cache. The code does not set restrictive file permissions around the credential write.
高
Python HTTP libraries
import urllib.request
The script reads local files and uploads their full bytes to Skywork object storage through the gateway. This is a direct exfiltration surface for sensitive files if invoked without clear consent.
高
Python HTTP libraries
req = urllib.request.Request(
The script reads local files and uploads their full bytes to Skywork object storage through the gateway. This is a direct exfiltration surface for sensitive files if invoked without clear consent.
高
Python HTTP libraries
with urllib.request.urlopen(req, timeout=60) as resp:
The script reads local files and uploads their full bytes to Skywork object storage through the gateway. This is a direct exfiltration surface for sensitive files if invoked without clear consent.
高
Python file write/append
with open(out_path, "w", encoding="utf-8") as f:
The script writes search results to a filename derived from the raw query string. A crafted query can influence the output path and leave sensitive search context on disk.
高
Hidden file in home directory
2. Cached token file `~/.skywork_token` → validate via API, if valid, use it
The instructions explicitly use a cached ~/.skywork_token credential file. Persistent hidden-token storage is a real credential exposure risk.
高
Hidden file access
2. Cached token file `~/.skywork_token` → validate via API, if valid, use it
The instructions explicitly use a cached ~/.skywork_token credential file. Persistent hidden-token storage is a real credential exposure risk.
中
Python HTTP libraries
from urllib.request import Request, urlopen
The script uploads user-provided files to the Skywork Office parse service and streams results back. This is a real external data transfer risk for sensitive documents.
中
Hardcoded URL
SKYWORK_OFFICE_URL - Base URL (default: https://api-tools.skywork.ai/theme-gateway)
The script uploads user-provided files to the Skywork Office parse service and streams results back. This is a real external data transfer risk for sensitive documents.
中
Python file write/append
with open(args.output, "w", encoding="utf-8") as f:
The optional output path writes parsed document content to disk. A user-controlled path can overwrite writable files or leave sensitive extracted text behind.
中
Python HTTP libraries
import urllib.request
The script sends prompts, references, uploaded file metadata, and tokens to Skywork generation or edit APIs, then downloads the PPTX result. This is intentional but security relevant network transfer.
中
Python HTTP libraries
req = urllib.request.Request(
The script sends prompts, references, uploaded file metadata, and tokens to Skywork generation or edit APIs, then downloads the PPTX result. This is intentional but security relevant network transfer.
中
Python HTTP libraries
with urllib.request.urlopen(req, timeout=600) as resp:
The script sends prompts, references, uploaded file metadata, and tokens to Skywork generation or edit APIs, then downloads the PPTX result. This is intentional but security relevant network transfer.
中
Python HTTP libraries
req2 = urllib.request.Request(download_url, method="GET")
The script sends prompts, references, uploaded file metadata, and tokens to Skywork generation or edit APIs, then downloads the PPTX result. This is intentional but security relevant network transfer.
中
Python HTTP libraries
with urllib.request.urlopen(req2, timeout=120) as r:
The script sends prompts, references, uploaded file metadata, and tokens to Skywork generation or edit APIs, then downloads the PPTX result. This is intentional but security relevant network transfer.
中
Temp directory access
log_file = f"/tmp/ppt_run_{session_id}.log" if args.log_path == "" else args.log_path
The script creates or appends log files and writes the generated PPTX to a caller-controlled output path. This can expose content in logs or overwrite writable files if paths are unsafe.
中
Python file write/append
with open(log_file, "a", encoding="utf-8") as f:
The script creates or appends log files and writes the generated PPTX to a caller-controlled output path. This can expose content in logs or overwrite writable files if paths are unsafe.
中
Python file write/append
open(log_file, "w").close() # clear previous run
The script creates or appends log files and writes the generated PPTX to a caller-controlled output path. This can expose content in logs or overwrite writable files if paths are unsafe.
中
Python file write/append
with open(out_abs, "wb") as f:
The script creates or appends log files and writes the generated PPTX to a caller-controlled output path. This can expose content in logs or overwrite writable files if paths are unsafe.
中
Hardcoded URL
API_BASE = os.environ.get("SKYWORK_API_BASE", "https://api.skywork.ai")
The authentication module contacts Skywork login and token validation endpoints. This sends authentication state to an external service and is security relevant.
中
Hardcoded URL
LOGIN_BASE_URL = os.environ.get("SKYWORK_WEB_BASE", "https://skywork.ai")
The authentication module contacts Skywork login and token validation endpoints. This sends authentication state to an external service and is security relevant.
中
Python environment access
API_BASE = os.environ.get("SKYWORK_API_BASE", "https://api.skywork.ai")
The API and web login bases are environment-overridable. This can redirect authentication traffic if the environment is not trusted.
中
Python environment access
LOGIN_BASE_URL = os.environ.get("SKYWORK_WEB_BASE", "https://skywork.ai")
The API and web login bases are environment-overridable. This can redirect authentication traffic if the environment is not trusted.
中
Python environment access
env_token = os.environ.get("SKYBOT_TOKEN", "")
The script reads SKYBOT_TOKEN from the environment and uses it as an authentication token. Environment-sourced credentials are sensitive and later authorize network calls.
中
Python environment access
env_token = os.environ.get("SKYBOT_TOKEN", "")
The script reads SKYBOT_TOKEN from the environment and uses it as an authentication token. Environment-sourced credentials are sensitive and later authorize network calls.
中
Python HTTP libraries
import urllib.request
The script sends search queries to a Skywork web search API with an authentication token. Queries can contain sensitive project or business context.
中
Python HTTP libraries
req = urllib.request.Request(
The script sends search queries to a Skywork web search API with an authentication token. Queries can contain sensitive project or business context.
中
Python HTTP libraries
with urllib.request.urlopen(req, timeout=30) as resp:
The script sends search queries to a Skywork web search API with an authentication token. Queries can contain sensitive project or business context.
中
Temp file creation
import tempfile
The script creates a temporary directory for search result files. Temporary storage is legitimate but can retain sensitive query results after the run.
中
Temp file creation
out_dir = tempfile.mkdtemp(prefix="web_search_")
The script creates a temporary directory for search result files. Temporary storage is legitimate but can retain sensitive query results after the run.
中
Ruby/shell backtick execution
```bash
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
中
Ruby/shell backtick execution
```
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
中
Ruby/shell backtick execution
1. Environment variable `SKYBOT_TOKEN` → if set, use directly
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
中
Ruby/shell backtick execution
2. Cached token file `~/.skywork_token` → validate via API, if valid, use it
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
中
Ruby/shell backtick execution
**IMPORTANT - Login URL handling**: If script output contains a line starting with `[LOGIN_URL]`, yo
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
中
Ruby/shell backtick execution
```bash
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
中
Ruby/shell backtick execution
```
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
中
Ruby/shell backtick execution
> After this check, replace `python` with the discovered `$PYTHON_CMD` (e.g. `python3`) in all subse
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
中
Ruby/shell backtick execution
0. **REQUIRED FIRST STEP** — Read [workflow_generate.md](workflow_generate.md) NOW, before taking an
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
中
Ruby/shell backtick execution
1. **Environment check** — run the check above to get `$PYTHON_CMD`.
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
中
Ruby/shell backtick execution
2. **Upload reference files** (if the user provides local files as content source) — parse the file
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
中
Ruby/shell backtick execution
3. **Web search** (required if no relevant content is already in the conversation) — call web_search
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
中
Ruby/shell backtick execution
> **Important**: set exec tool `yieldMs` to `600000` (10 minutes).
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
中
Ruby/shell backtick execution
5. **Deliver** — provide the absolute `.pptx` path and the download URL.
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
中
Ruby/shell backtick execution
1. **Environment check** — run the check above to get `$PYTHON_CMD`.
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
中
Ruby/shell backtick execution
2. **Locate the template** — extract the absolute path of the local `.pptx` from the user's message;
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
中
Ruby/shell backtick execution
3. **Upload the template** — upload it and extract `TEMPLATE_URL` from the output.
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
中
Ruby/shell backtick execution
4. **Upload reference files** (if the user provides additional local files as content source) — pars
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
中
Ruby/shell backtick execution
5. **Web search** (required if no relevant content is already in the conversation) — call web_search
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
中
Ruby/shell backtick execution
> **Important**: set exec tool `yieldMs` to `600000` (10 minutes).
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
中
Ruby/shell backtick execution
7. **Deliver** — provide the absolute `.pptx` path, the download URL, and the template filename used
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
中
Ruby/shell backtick execution
1. **Environment check** — run the check above to get `$PYTHON_CMD`.
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
中
Ruby/shell backtick execution
3. **Run the script** with `--pptx-url`:
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
中
Ruby/shell backtick execution
```bash
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
中
Ruby/shell backtick execution
```
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
中
Ruby/shell backtick execution
> **Important**: set exec tool `yieldMs` to `600000` (10 minutes).
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
中
Ruby/shell backtick execution
```bash
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
中
Ruby/shell backtick execution
```
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
中
Ruby/shell backtick execution
- **Insufficient benefit**: When calling scripts (generate, imitate, or edit), the script or log may
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
中
Ruby/shell backtick execution
- **Format**: One short sentence in the user's language + a link like `[Upgrade now →](url)` or the
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
中
Ruby/shell backtick execution
- **URL**: Extract the upgrade URL from the log/script output (e.g. the `at https://...` part).
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
中
Ruby/shell backtick execution
- **Python 3.8+** (required) — `python3` / `python` must be on PATH
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
中
Shell command substitution
echo "Found Python: $PYTHON_CMD ($($PYTHON_CMD --version))"
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
中
Template literal with command substitution
```bash
The static pattern is present, and I did not find enough context to dismiss it safely. Keeping the finding confirmed with low confidence.
中
Shell command substitution
PPT_LOG=/tmp/ppt_$(date +%s).log
The workflow instructs shell command substitution while running and monitoring background PPT jobs. It is expected process control, but it requires local command execution.
中
Shell command substitution
PPT_PID=$(grep '^\[PID\]' "$PPT_LOG" | tail -1 | awk '{print $2}')
The workflow instructs shell command substitution while running and monitoring background PPT jobs. It is expected process control, but it requires local command execution.
中
Temp directory access
PPT_LOG=/tmp/ppt_$(date +%s).log
The workflow creates a predictable timestamp-based log file under /tmp. Logs may contain PPT progress or error details and can persist after execution.
中
Shell command substitution
PPT_LOG=/tmp/ppt_$(date +%s).log
The workflow instructs shell command substitution while running and monitoring background PPT jobs. It is expected process control, but it requires local command execution.
中
Shell command substitution
PPT_PID=$(grep '^\[PID\]' "$PPT_LOG" | tail -1 | awk '{print $2}')
The workflow instructs shell command substitution while running and monitoring background PPT jobs. It is expected process control, but it requires local command execution.
中
Temp directory access
cat > /tmp/ppt_reference.md << 'REFERENCE_EOF'
The workflow writes reference material and logs under /tmp using predictable names. These files can contain sensitive source content or generation details.
中
Temp directory access
- **--reference-file** (optional): Pass the path to the temp file written at the end of Step 2 (e.g.
The workflow writes reference material and logs under /tmp using predictable names. These files can contain sensitive source content or generation details.
中
Temp directory access
PPT_LOG=/tmp/ppt_$(date +%s).log
The workflow writes reference material and logs under /tmp using predictable names. These files can contain sensitive source content or generation details.
中
Temp directory access
--reference-file /tmp/ppt_reference.md \
The workflow writes reference material and logs under /tmp using predictable names. These files can contain sensitive source content or generation details.
中
Shell command substitution
PPT_LOG=/tmp/ppt_$(date +%s).log
The workflow instructs shell command substitution while running and monitoring background PPT jobs. It is expected process control, but it requires local command execution.
中
Shell command substitution
PPT_PID=$(grep '^\[PID\]' "$PPT_LOG" | tail -1 | awk '{print $2}')
The workflow instructs shell command substitution while running and monitoring background PPT jobs. It is expected process control, but it requires local command execution.
中
Temp directory access
cat > /tmp/ppt_reference.md << 'REFERENCE_EOF'
The workflow writes reference material, uses /tmp paths, or documents template paths. Temporary files and local paths can expose sensitive presentation content.
中
Temp directory access
- **--reference-file** (optional): Path to the temp file written at the end of Step 3 (e.g. `/tmp/pp
The workflow writes reference material, uses /tmp paths, or documents template paths. Temporary files and local paths can expose sensitive presentation content.
中
Temp directory access
PPT_LOG=/tmp/ppt_$(date +%s).log
The workflow writes reference material, uses /tmp paths, or documents template paths. Temporary files and local paths can expose sensitive presentation content.
中
Temp directory access
--reference-file /tmp/ppt_reference.md \
The workflow writes reference material, uses /tmp paths, or documents template paths. Temporary files and local paths can expose sensitive presentation content.
中
Temp directory access
| Use this template to make a PPT on AI trends — template at `/tmp/style.pptx` | ✅ Imitate |
The workflow writes reference material, uses /tmp paths, or documents template paths. Temporary files and local paths can expose sensitive presentation content.
低
Hardcoded URL
SKYWORK_AUTH_API_BASE = "https://api.skywork.ai"
This config defines external Skywork API endpoints that the skill uses for authentication, parsing, upload, search, and PPT generation. Network destinations are expected but still require disclosure and trust in a third-party service.
低
Hardcoded URL
SKYWORK_WEB_BASE = "https://skywork.ai"
This config defines external Skywork API endpoints that the skill uses for authentication, parsing, upload, search, and PPT generation. Network destinations are expected but still require disclosure and trust in a third-party service.
低
Hardcoded URL
SKYWORK_OFFICE_URL = os.environ.get("SKYWORK_OFFICE_URL", "https://api.skywork.ai/skywork-office-rou
This config defines external Skywork API endpoints that the skill uses for authentication, parsing, upload, search, and PPT generation. Network destinations are expected but still require disclosure and trust in a third-party service.
低
Hardcoded URL
SKYWORK_GATEWAY_URL = os.environ.get("SKYWORK_GATEWAY_URL", "https://api-tools.skywork.ai/theme-gate
This config defines external Skywork API endpoints that the skill uses for authentication, parsing, upload, search, and PPT generation. Network destinations are expected but still require disclosure and trust in a third-party service.
低
Python environment access
SKYWORK_OFFICE_URL = os.environ.get("SKYWORK_OFFICE_URL", "https://api.skywork.ai/skywork-office-rou
The service base URL can be overridden from the environment. That is useful for deployment but can redirect uploads or tokens if the execution environment is compromised.
低
Python environment access
SKYWORK_GATEWAY_URL = os.environ.get("SKYWORK_GATEWAY_URL", "https://api-tools.skywork.ai/theme-gate
The service base URL can be overridden from the environment. That is useful for deployment but can redirect uploads or tokens if the execution environment is compromised.
低
Python environment access
payload["source_platform"] = "skyclaw" if os.environ.get("POD_TYPE", "") == "skyclaw" else ""
The script reads POD_TYPE from the environment to set source_platform. The value is low sensitivity but confirms environment-dependent behavior.
低
Python environment access
payload = {"query": query, "source_platform": "skyclaw" if os.environ.get("POD_TYPE", "") == "skycla
The script reads POD_TYPE from the environment to set source_platform. This is low sensitivity but confirms environment-dependent behavior.
リスク要因
🌐 ネットワークアクセス (34)
scripts/config.py:9 scripts/config.py:12 scripts/config.py:16 scripts/config.py:19 scripts/local_pptx_ops.py:91 scripts/parse_file.py:24 scripts/parse_file.py:12 scripts/run_ppt_write.py:16 scripts/run_ppt_write.py:296 scripts/run_ppt_write.py:305 scripts/run_ppt_write.py:328 scripts/run_ppt_write.py:329 scripts/run_ppt_write.py:231 scripts/skywork_auth.py:41 scripts/skywork_auth.py:42 scripts/upload_files.py:15 scripts/upload_files.py:81 scripts/upload_files.py:91 scripts/upload_files.py:106 scripts/web_search.py:14 scripts/web_search.py:24 scripts/web_search.py:31 SKILL.md:61 SKILL.md:115 SKILL.md:156 workflow_edit.md:49 workflow_generate.md:21 workflow_generate.md:27 workflow_generate.md:28 workflow_generate.md:133 workflow_imitate.md:46 workflow_imitate.md:52 workflow_imitate.md:53 workflow_imitate.md:117
🔑 環境変数 (8)
📁 ファイルシステムへのアクセス (33)
scripts/parse_file.py:157 scripts/run_ppt_write.py:244 scripts/run_ppt_write.py:34 scripts/run_ppt_write.py:245 scripts/run_ppt_write.py:330 scripts/skywork_auth.py:6 scripts/skywork_auth.py:44 scripts/skywork_auth.py:6 scripts/skywork_auth.py:44 scripts/skywork_auth.py:172 scripts/upload_files.py:106 scripts/web_search.py:13 scripts/web_search.py:60 scripts/web_search.py:71 SKILL.md:28 SKILL.md:28 SKILL.md:53 workflow_edit.md:52 workflow_edit.md:73 workflow_edit.md:45 workflow_generate.md:136 workflow_generate.md:156 workflow_generate.md:87 workflow_generate.md:117 workflow_generate.md:128 workflow_generate.md:132 workflow_imitate.md:120 workflow_imitate.md:141 workflow_imitate.md:74 workflow_imitate.md:100 workflow_imitate.md:111 workflow_imitate.md:116 workflow_imitate.md:187
⚙️ 外部コマンド (43)
scripts/skywork_auth.py:87 scripts/skywork_auth.py:90 scripts/skywork_auth.py:93 SKILL.md:21-24 SKILL.md:24-27 SKILL.md:27-28 SKILL.md:28-31 SKILL.md:31-50 SKILL.md:50-69 SKILL.md:69-71 SKILL.md:71 SKILL.md:78-79 SKILL.md:79-80 SKILL.md:80 SKILL.md:81-83 SKILL.md:83 SKILL.md:84-92 SKILL.md:92-93 SKILL.md:93-94 SKILL.md:94-95 SKILL.md:95 SKILL.md:96-98 SKILL.md:98 SKILL.md:99-109 SKILL.md:109-111 SKILL.md:111-112 SKILL.md:112-117 SKILL.md:117-118 SKILL.md:118 SKILL.md:125-140 SKILL.md:140-148 SKILL.md:148-155 SKILL.md:155-156 SKILL.md:156-162 SKILL.md:162 SKILL.md:65 SKILL.md:50-69 workflow_edit.md:45 workflow_edit.md:71 workflow_generate.md:128 workflow_generate.md:154 workflow_imitate.md:111 workflow_imitate.md:139
検出されたパターン
System reconnaissance×3
監査者: codex 監査履歴を表示 →
このレポートを共有・引用
バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。
レポートリンクをコピー
https://skillstore.io/skills/skyworkai-skywork-ppt/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdownバッジ
[](https://skillstore.io/skills/skyworkai-skywork-ppt?utm_source=security_passport_badge)HTMLバッジ
<a href="https://skillstore.io/skills/skyworkai-skywork-ppt?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/skyworkai-skywork-ppt/security.svg" alt="Skillstore security assessment" loading="lazy"></a>埋め込みカード
<iframe src="https://skillstore.io/embed/skills/skyworkai-skywork-ppt.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学術引用 (APA · BibTeX · CFF)
APA形式の引用
SkyworkAI. (2026). skywork-ppt security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/skyworkai-skywork-ppt/audits/4BibTeX形式の引用
@techreport{skyworkai-skyworkai-skywork-ppt-2026,
author = {SkyworkAI},
title = {skywork-ppt security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/skyworkai-skywork-ppt/audits/4},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "skywork-ppt security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
- name: "SkyworkAI"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/skyworkai-skywork-ppt/audits/4"
identifiers:
- type: other
value: "skillstore:skyworkai-skywork-ppt:audit:4"
description: "Skillstore immutable audit report identifier"
Skillstore スコア
このスコアの理由 証拠の信頼度: 中 45
アーキテクチャ
85
保守性
87
コンテンツ
69
コミュニティ
83
仕様準拠
作成できるもの
トピックからブリーフィングデッキを作成
トピック、対象者、スライド数、補足メモを、進捗ログとダウンロードリンク付きの生成済み PPTX に変換します。
会社のプレゼンテーションスタイルを再利用
PPTX テンプレートをアップロードし、そのテンプレートのレイアウトと視覚構造に沿った新しいデッキを作成します。
既存のスライドファイルを整理
デッキを生成バックエンドに送信せずに、ローカルでスライドの確認、削除、並べ替え、抽出、または結合を行います。
これらのプロンプトを試す
シンプルなデッキを生成
一般的なビジネス向けに、再生可能エネルギーのトレンドについての英語 PPTX を作成してください。8 枚のスライドを使用し、清潔感のあるプロフェッショナルなスタイルにしてください。
参考ファイルから生成
添付の市場レポートから 10 枚のスライドの投資家向けブリーフィングを作成してください。主要な数値、日付、会社名は正確に保持してください。
テンプレートスタイルを模倣
このローカルパスにある PPTX テンプレートを使用して、当社の 2026 年製品ロードマップに関する 12 枚のスライドのデッキを作成してください。テンプレート構造に合わせてください。
デッキを編集して再構成
この PPTX URL を編集して、スライド 2 の後に新しいエグゼクティブサマリーを追加し、その後スライド 4 と 5 を削除したローカルコピーを作成してください。
ベストプラクティス
- アップロード、解析、編集、またはテンプレート模倣ワークフローを使用する前に、ファイルに機密データが含まれているかどうかを確認してください。
- 生成を開始する前に、スライド数、対象者、言語、スタイル要件を指定してください。
- バックエンド生成が不要な単純な削除、並べ替え、抽出、または結合タスクには、ローカルスライド操作を使用してください。
回避
- 明示的な承認なしに、規制対象、秘密、または顧客機密のファイルをアップロードしないでください。
- 時間的な影響を受けやすい主張については、ソースの日付を確認せずに生成された調査結果に依存しないでください。
- トークン保存とクリーンアップを確認せずに、共有マシンで認証フローを実行しないでください。
よくある質問
このスキルには Skywork アカウントが必要ですか？
はい。生成、編集、アップロード、解析、検索のワークフローには Skywork 認証が必要です。
ローカルの PPTX ファイルだけで動作しますか？
削除、並べ替え、抽出、結合、基本的なファイル情報タスクについては可能です。生成と AI 編集では外部サービスを使用します。
私のファイルはアップロードされますか？
解析、テンプレート模倣、または URL ベースの編集ワークフローを使用する場合、ファイルはアップロードされます。ローカルスライド操作ではバックエンドへのアップロードは不要です。
どの言語を生成できますか？
ワークフローは、英語や中国語など、検出されたユーザー言語をバックエンドに渡します。
会社のテンプレートを使用できますか？
はい。PPTX テンプレートパスを指定すると、模倣ワークフローがそれをアップロードし、スタイルとレイアウトの参考として使用します。
インストール前に何を確認すべきですか？
外部 API 呼び出し、トークンキャッシュの動作、ブラウザー起動サブプロセス、ローカルファイルアップロードワークフローを確認してください。
開発者情報
作成者
SkyworkAIライセンス
MIT
Skillstore リビジョン
r1
バージョンに関する注意
作者はバージョンを宣言していません。
参照
f93e9bb0daca99badb6a7e574b97737155d57cb3
メンテナンスの新しさ
2026/7/18
利用状況
51 ダウンロード · 140 閲覧
SkyworkAI のその他のスキル
すべて表示📦
skywork-music-maker
38MurekaでAI音楽を作成
大まかな音楽アイデアを、使いやすいAI生成プロンプトに変えるのは難しいものです。このスキルは、プロンプト構成、歌詞、Mureka APIによる生成、リファレンスのアップロード、音声のダウンロードをガイドします。
デザイン＆クリエイティブ 表示
📦
skywork-search
38SkyworkでWebを検索
最新の調査依頼には、モデルの学習データを超える情報源が必要です。このスキルはSkywork APIを使用してWebを検索し、情報源に基づく結果を保存します。
調査＆学習 表示
📦
skywork-design
38Skyworkでビジュアルアセットを作成
チームには、手動のデザイン設定なしで素早くビジュアルアセットを作成する手段が必要です。このスキルは、Skyworkの画像ワークフローを使用して、明確なプロンプトから画像を生成または編集します。
デザイン＆クリエイティブ 表示
📦
skywork-document
38ファイルからSkyworkドキュメントを作成
長いドキュメントの依頼では、多くの場合、構成、参照ファイル、整った形式での納品が必要です。このスキルはSkyworkのドキュメントサービスを使用し、プロンプトとアップロードされた資料から洗練されたファイルを作成します。
ドキュメント 表示
関連スキル
すべて表示📦
pptx
85PythonでPowerPointプレゼンテーションを作成
作成者 AutumnsGrove
洗練されたPowerPoint資料を手作業で作るのは時間がかかり、再現も困難です。このスキルは、python-pptxを使ったPPTXの作成、編集、自動化をClaude、Codex、Claude Codeに案内します。
オフィス＆レポート 表示
📦
ppt-orchestra-skill
78洗練された PowerPoint デッキを計画する
作成者 MiniMax-AI
大規模なデッキは、生成中に構成、スタイル、品質がぶれがちです。このスキルは、Claude、Codex、Claude Code に、スライド種別、デザインルール、コンパイル、QA のための再現可能な計画を提供します。
オフィス＆レポート 表示
📦
when-creating-presentations-use-pptx-generation
80アクセシブルなPowerPointデッキを作成
作成者 DNYoussef
手作業でのプレゼンテーション制作は、時間がかかり、一貫性を保ちにくい場合があります。このスキルは、Claude、Codex、またはClaude Codeが構造化されたPPTX生成と検証を進められるよう支援します。
オフィス＆レポート 表示
📦
pptx-prep
78PPTX生成前にプレゼンテーション資料を準備
作成者 xiaomengbi520
プレゼンテーション生成ツールは、元資料が不足していると、名前、写真、データ、ロゴを作り出してしまうことがよくあります。このスキルはまず要件を確認し、判断事項を収集し、よりクリーンなPPTX生成のためのマニフェストを作成します。
オフィス＆レポート 表示
📦
aippt
78テンプレートからAI PowerPointデッキを生成
作成者 Ceeon
既存テンプレートから洗練されたデッキを作成するのは、すべてのスライドでスタイルを維持する必要がある場合、時間がかかります。AIPPTは、テンプレートのエクスポート、コンテンツマッピング、AIスライド生成、PPTXパッケージ化の流れをユーザーに案内します。
オフィス＆レポート 表示
📦
nanobanana-ppt-skills
78ドキュメントからAI PowerPointデッキを作成
作成者 sickn33
ドキュメントをわかりやすいプレゼンテーションに変換するには、入念な計画と視覚的な方向性が必要です。このスキルは、ドキュメント分析とスタイル付き画像の計画を通じて、AI支援によるPPT作成をガイドします。
オフィス＆レポート 表示