跳到主要内容
知仓学习社ZHICANG

document-skills

Umbrella skill for document workflows (PDF/DOCX/XLSX/PPTX). Dispatches to the most specific document skill to reduce noise and improve routing preci…

执行命令写文件读文件联网读环境变量(配置)严重 0 · 高危 6foryourhealth111-pixel/Vibe-Skills

它会碰到什么

扫了多少40 个文本文件,430 KB
它会碰到什么执行命令写文件读文件联网读环境变量(配置)
命中总数41 处
命中统计严重 0 · 高 6 · 中 19 · 低 3

关于「读环境变量(配置)」:这个技能会读 process.env 之类的环境变量,但读到的都是端口、目录、超时这类配置项,没有读取密钥类变量。扫描规则原本把「读环境变量」一律算作「读凭据」,本站按变量名做了细化区分,命中明细仍如实列在下面。

逐条看命中(6 条严重或高危)
  • docx/ooxml/scripts/pack.py:103exec-spawn
    result = subprocess.run(
  • docx/ooxml/scripts/validation/redlining.py:153exec-spawn
    result = subprocess.run(
  • docx/ooxml/scripts/validation/redlining.py:185exec-spawn
    result = subprocess.run(
  • pptx/scripts/html2pptx.js:898cred-envread
    tmpDir = process.env.TMPDIR || '/tmp',
  • pptx/scripts/thumbnail.py:219exec-spawn
    result = subprocess.run(
  • pptx/scripts/thumbnail.py:237exec-spawn
    result = subprocess.run(

这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。

技能内容

Document Skills (Dispatcher)

Use this skill when the task is clearly “document work” but the exact format is not yet fixed, or when the user mixes multiple formats (e.g., “把论文里的表格做成 Excel,再导出 PDF 报告”).

Goal: fast dispatch to the most specific skill so we keep high hit-rate / low noise.

Quick dispatch rules

  1. PDF (.pdf, “PDF”, “pypdf”, “pdfplumber”, “render pages”)
  • Prefer the pdf skill.
  • Typical tasks: extract text/tables, render pages, review layout, generate PDF reports.
  1. Word / DOCX (.docx, “Word”, “tracked changes”, “python-docx”)
  • Prefer the docx skill (or doc when the task is explicitly .docx formatting/layout heavy and the doc skill is requested/required by your environment).
  1. Excel / Spreadsheets (.xlsx, .csv, .tsv, “Excel”, “openpyxl”, “pivot table”)
  • Prefer the xlsx skill.
  • If the task is more “tabular ETL + analysis” than “Excel formatting”, you can use spreadsheet instead (but keep output fidelity requirements in mind).
  1. Slides / Posters / PPTX (.pptx, “slides”, “poster”, “deck”, “PowerPoint”)
  • Prefer scientific-slides for scientific slide decks.
  • Prefer pptx-posters for posters.
  • Use infographics / markdown-mermaid-writing when the user wants diagrams rather than editable slides.

Safety / noise controls

  • Do not guess formats. If the user didn’t specify a target file type, ask: “你最终需要交付的是 PDF / DOCX / XLSX / PPTX 哪一种?”
  • If multiple outputs are requested, sequence them: source-of-truth document → derived exports (e.g., XLSX → charts → PPTX → PDF).

Output expectations

  • Always preserve formatting when the user provides a template.
  • For any generated file, clearly state: output path(s) and how to verify (open in Office/Preview, check page breaks, confirm no Excel formula errors, etc.).

想直接用这个技能?

本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。

它属于哪个仓库

星标★ 3,314
本站分层T1
该仓技能数258
原文件路径bundled/skills/document-skills/SKILL.md

同一个仓库里的其他技能

看这个仓库的全部 258 个技能