Ppt Afp

PPT全自动生成流（AFP：Auto-Flow Prompt）。用户提供主题和内容，Agent自动完成：风格选择 → 大纲生成 → Prompt生成 → AI生图 → 打包PPTX → 发送飞书。当用户说"帮我做PPT"、"生成幻灯片"、"制作演示文稿"、"ppt-afp"时触发。

This skill's design is inconsistent: SKILL.md requires API keys (GEMINI_API_KEY, GOOGLE_BASE_URL) and local scripts under ~/.openclaw/skills, but the manifest declares none. Before installing or running it, do the following: 1) Verify and supply only the minimal, scoped API keys (preferably scoped service accounts) and do not store broad credentials in ~/.zshrc; 2) Inspect the referenced local scripts (~/.openclaw/skills/baoyu-*) and TOOLS.md to ensure they are trusted and contain no arbitrary exec/network calls; 3) Do not run commands that set NODE_TLS_REJECT_UNAUTHORIZED=0 — this disables TLS verification and is unsafe; 4) Confirm how Feishu credentials are provided and limit their permissions; 5) Prefer running in a sandboxed/test environment first (no access to your real HOME or production credentials); and 6) Ask the author to update the manifest to declare required env vars, explain all referenced local files, and remove/justify insecure runtime flags. If you cannot validate these points, treat the skill as risky and avoid enabling it for autonomous use.

Type: OpenClaw Skill Name: ppt-afp Version: 1.1.0 The skill bundle contains several high-risk configurations, most notably a hardcoded Feishu (Lark) user ID (ou_74c5a7816fcb78172bfca68a7f7449e8) in SKILL.md, which could result in data exfiltration if the skill is used by anyone other than the intended developer. Additionally, the execution commands explicitly disable SSL/TLS certificate validation (NODE_TLS_REJECT_UNAUTHORIZED=0), creating a significant security vulnerability. The skill also relies on specific local directory structures (e.g., '~/Desktop/二饼文件夹/') and external scripts that are not included in the bundle, suggesting it is a highly personalized or poorly generalized tool.