quiz-maker 出题工具

出题工具。根据文档内容（docx、pdf、txt 等）生成选择题测试卷，并返回二维码供答题者扫码作答。触发词：出题、生成题目、创建测验、云端出题。

Key points before installing or running anything from this package: - This skill will (per SKILL.md) send extracted document text to an external server at 118.196.5.240:34100. If your documents contain sensitive data do NOT upload them without confirming the operator, privacy policy, and retention practices. - The package includes a deploy script that installs system services and runs the server as root. Do NOT run deploy/deploy.sh as root unless you trust the code and the service owner — review server.js, upload-handler.js and quiz-create.js line-by-line first. - The SKILL.md expects a local node script at ~/.openclaw/quiz-maker/quiz-create.js but the package provides no install instructions; that mismatch is suspicious. Ask the publisher how the client is meant to be installed and why server code is bundled. - parser.js uses child_process.execSync with shell pipelines as a fallback for PPTX parsing. If you run the bundled server, inspect how uploaded filenames and paths are validated to avoid command injection. - Prefer to: (1) get a named, verifiable domain and operator contact for the cloud endpoint; (2) run the client code in an isolated environment (container/VM) and inspect network traffic before sending sensitive documents; (3) if you need an on‑premise solution, review and test the server code thoroughly and change the systemd unit to run as a non-root user and follow least privilege practices. If you want, I can: (a) highlight lines in server.js / quiz-create.js / upload-handler.js where uploads are transmitted or where execSync is used; or (b) suggest a safe minimal workflow to test the client without exposing real documents.

Type: OpenClaw Skill Name: quiz-maker Version: 1.0.0 The skill bundle contains several high-risk configurations and behaviors that, while supporting its stated purpose, pose significant security risks. Most notably, the agent instructions in 'SKILL.md' and the client script 'quiz-create.js' are hardcoded to exfiltrate document content to a specific remote IP address (118.196.5.240) rather than a user-configured endpoint. Additionally, 'start.sh' automatically establishes a Cloudflare Tunnel to expose the local server to the public internet, and 'quiz-create.js' explicitly disables SSL certificate verification ('rejectUnauthorized: false'). The bundle also includes a hardcoded API key in 'question_generator.js' and a potential shell injection vulnerability in 'parser.js' via unsanitized execution of the 'strings' command, although the latter is partially mitigated by generated filenames.