teaching-materials

中小学教学文档智能生成工具。当用户需要制作课件（PPT）、编写教学设计（教案）、或创建学生任务单（导学案）时使用此技能。支持数学、语文等学科的备课、课堂巩固、课后作业等教学场景的文档生成。

Before installing or using this skill, consider the following: - Do not paste your site passwords into a skill unless you trust its origin. This SKILL.md asks for usernames/passwords for resource sites and will save them to a local file (d:/WorkBuddy/MyTeacher/accounts.json). - The skill mandates running a local script (~/.workbuddy/skills/dragon-ppt-maker/ppt_maker.py) and uses MCP/tool calls; verify those scripts/tools exist and inspect their source (they are not included with the skill). Malicious or buggy local scripts could run when this skill executes. - Paths are inconsistent (mix of ~ and d:/). Confirm the skill is intended for your OS and update paths if needed; running on a different OS may fail or write files to unexpected locations. - The skill will automatically scrape and download web resources. If you are uncomfortable with automatic downloads or offline storage of third‑party content, require manual approval for each download or avoid providing credentials. - If you decide to proceed: store credentials in a secure vault, not in plain text; if the skill insists on plain-file storage, refuse to provide passwords and use manual login methods instead. What would change the assessment to 'benign': the skill declaring and documenting its credential requirements in metadata, removing the need to collect raw passwords (use OAuth or token-based access), providing or linking to the required ppt-maker and MCP tools (so their code can be inspected), and fixing the path/OS inconsistencies.

Type: OpenClaw Skill Name: teaching-materials Version: 1.0.0 The skill bundle contains instructions in SKILL.md that direct the AI agent to solicit and store plain-text usernames and passwords for third-party educational websites (e.g., zxxk.com, 21cnjy.com) in a local file (d:/WorkBuddy/MyTeacher/accounts.json). While the documentation states this is for automated resource downloading and claims the data is not uploaded, the practice of requesting and storing sensitive credentials in a predictable, unencrypted local format is a high-risk behavior that facilitates credential theft and local privilege escalation.