跳到主要内容
知仓学习社ZHICANG

codex-ppt

Generate visually unified image-based PPT/PPTX decks from articles, reports, papers, notes, or outlines.

读凭据执行命令读文件联网写文件严重 12 · 高危 17ningzimu/codex-ppt-skill

它会碰到什么

扫了多少39 个文本文件,261 KB
它会碰到什么读凭据执行命令读文件联网写文件
命中总数41 处
命中统计严重 12 · 高 17 · 中 10 · 低 2
逐条看命中(29 条严重或高危)
  • 严重 docs/backend-selection.md:18cred-paths
    - CLI/API fallback loads `~/.codex-ppt-skill/.env` automatically. Run the CLI normally; do not manually parse `.env` or ask for configuration before an error.
  • 严重 docs/backend-selection.md:21cred-paths
    If CLI/API fallback is selected, read `cli-api-fallback.md` before generating images. For API key, base URL, model, and `.env` configuration, read `image-model-
  • 严重 docs/backend-selection.md:34cred-paths
    我检查后没有可用的内置图片生成工具,或内置工具缺少本页必需能力,因此准备使用本地 API/CLI fallback 生成样张,读取 ~/.codex-ppt-skill/.env 中的 OPENAI_BASE_URL / CODEX_PPT_IMAGE_MODEL 配置。可以开始生成 1 页样张吗?
  • 严重 docs/cli-api-fallback.md:17cred-paths
    The fallback CLI loads `~/.codex-ppt-skill/.env` automatically for `OPENAI_API_KEY`, `OPENAI_BASE_URL`, and `CODEX_PPT_IMAGE_MODEL`. Do not manually parse `.env
  • 严重 docs/image-model-configuration.md:30cred-paths
    Configure provided API settings with `scripts/codex_ppt_runtime.py config --api-key`. The config command writes `~/.codex-ppt-skill/.env`.
  • 严重 docs/image-model-configuration.md:79cred-paths
    ~/.codex-ppt-skill/.env
  • 严重 docs/image-model-configuration.md:84cred-paths
    Process environment variables override `.env` values. A command-line `--model` overrides `CODEX_PPT_IMAGE_MODEL` for that single command.
  • 严重 docs/project-assembly-and-reporting.md:125cred-paths
    `assemble_ppt.py` supports `16:9` and `4:3`. Use `16:9` unless the user requests otherwise. `image_gen.py` loads `~/.codex-ppt-skill/.env` automatically for `OP
  • 严重 scripts/codex_ppt_runtime.py:45cred-paths
    return home / ".env"
  • 严重 scripts/codex_ppt_runtime.py:262cred-paths
    config = subparsers.add_parser("config", help="Write or update shared .env")
  • 严重 scripts/image_gen.py:69cred-paths
    return _runtime_home() / ".env"
  • 严重 SKILL.md:151cred-paths
    - `docs/image-model-configuration.md`: API key, base URL, model, `.env`; read only when config is needed.
  • scripts/assemble_ppt.py:18cred-envread
    runtime_home = os.path.expanduser(os.environ.get("CODEX_PPT_HOME", "~/.codex-ppt-skill"))
  • scripts/codex_ppt_runtime.py:31cred-envread
    return Path(os.getenv("CODEX_PPT_HOME", DEFAULT_RUNTIME_HOME)).expanduser()
  • scripts/codex_ppt_runtime.py:110cred-envread
    if os.getenv(key):
  • scripts/codex_ppt_runtime.py:111cred-envread
    values[key] = os.environ[key]
  • scripts/codex_ppt_runtime.py:138exec-spawn
    subprocess.run(cmd, check=True)
  • scripts/codex_ppt_runtime.py:175exec-spawn
    proc = subprocess.run(
  • scripts/image_gen.py:65cred-envread
    return Path(os.getenv("CODEX_PPT_HOME", DEFAULT_RUNTIME_HOME)).expanduser()
  • scripts/image_gen.py:82cred-envread
    if key not in ENV_FIELDS or os.getenv(key):
  • scripts/image_gen.py:85cred-envread
    os.environ[key] = value
  • scripts/image_gen.py:89cred-envread
    return os.getenv("CODEX_PPT_IMAGE_MODEL", DEFAULT_MODEL)
  • scripts/image_gen.py:93cred-envread
    return os.getenv("OPENAI_BASE_URL") or None
  • scripts/image_gen.py:151cred-envread
    if os.getenv("OPENAI_API_KEY"):
  • scripts/image_gen.py:664cred-envread
    provider = create_image_provider(api_key=os.getenv("OPENAI_API_KEY"), base_url=_api_base_url())
  • scripts/image_gen.py:786cred-envread
    provider = create_image_provider(api_key=os.getenv("OPENAI_API_KEY"), base_url=_api_base_url())
  • scripts/image_gen.py:861cred-envread
    provider = create_image_provider(api_key=os.getenv("OPENAI_API_KEY"), base_url=_api_base_url())
  • scripts/image_providers/openai_compatible.py:18cred-envread
    return Path(os.getenv("CODEX_PPT_HOME", DEFAULT_RUNTIME_HOME)).expanduser()
  • scripts/remove_chroma_key.py:31cred-envread
    home = Path(os.getenv("CODEX_PPT_HOME", DEFAULT_RUNTIME_HOME)).expanduser()

这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。

技能内容

Codex PPT

Overview

This skill creates image-based PowerPoint decks from source material. Each slide is a complete 16:9 generated image. Final images are assembled into .pptx with scripts/assemble_ppt.py.

Use this when the user wants a visually unified presentation and accepts full-slide image pages. Do not use it when every textbox, chart, or shape must remain separately editable.

Prefer the built-in image generation/editing tool. Use scripts/image_gen.py only when the built-in backend is unavailable, lacks a required capability, or the user explicitly asks for API/CLI mode.

Hard Constraints

  • Read the relevant Reference Map files before each phase. This file is the orchestration contract; detailed rules live in docs/ and worker prompts in prompts/.
  • Respect approval gates. Do not create final deck_spec.json, speech.md, prompt jobs, slide images, or .pptx before the approvals in docs/workflow-gates-and-progress.md.
  • After the user approves the sample slide and authorizes full-deck generation, every remaining slide image job must be dispatched to a slide subagent whenever subagents are available.
  • The main agent owns orchestration, prompt jobs, state recording, QA, speaker notes, and assembly. Do not silently replace available slide subagents with sequential production.
  • Every final origin_image/slide_XX.png must be generated by the selected image backend: built-in image generation/editing tool or scripts/image_gen.py.
  • Local drawing, Pillow, SVG, HTML/CSS/canvas screenshots, python-pptx/PptxGenJS layouts, and manual overlays are failure modes, not fallbacks.
  • The selected image backend must stay fixed after backend confirmation. Do not let subagents switch backend for convenience.
  • After sample approval, record how the approved sample was generated and pass that exact method to every slide subagent.
  • Slide dispatch and result state must be recorded with the bundled scripts. Chat messages alone do not make a slide dispatched or complete.
  • If a required subagent, image backend, or required-image path is unavailable, stop and report a blocker with the slide id and evidence. Do not create a lower-quality replacement.

Visible Progress

For non-trivial decks, keep a user-visible checklist with one active step. Canonical completion evidence is in docs/workflow-gates-and-progress.md.

Default visible steps:

  1. Prepare source, outline, style, and backend decisions.
  2. Generate and approve one sample slide.
  3. Prepare slide jobs and slide state.
  4. Dispatch slide subagents.
  5. Record generated slide results.
  6. QA, repair, notes, and PPT assembly.

Do not mark a step complete from chat alone; use real files or script-recorded state.

Default Workflow

  1. Understand the source content.
  • Identify topic, audience, goal, page count, style/brand constraints, and sections to include or exclude.
  • If no page count is specified, choose a practical count. Typical decks are 8-12 slides.
  1. Plan the deck outline.
  • Before writing or updating outline.md, read docs/workflow-gates-and-progress.md and docs/outline-style-and-sample.md.
  • Draft slide roles and required source images. Ask for confirmation, then stop before style, backend, sample, or downstream artifacts until approved.
  1. Confirm a unified visual style.
  • Before offering style options or using files from references/, read docs/outline-style-and-sample.md.
  • Offer 2-3 concrete style directions, recommend one, wait for confirmation, then keep one visual identity while varying layouts by page role.
  1. Confirm the image backend.
  • Before generating any slide image, read docs/backend-selection.md.
  • Check whether a built-in image tool is callable, state what you checked, name the backend, explain fallback status, and wait for confirmation.
  • If CLI/API fallback is selected, read docs/cli-api-fallback.md. Read docs/image-model-configuration.md only after config errors or explicit API-setting requests.
  1. Generate one sample slide for approval.
  • Before generating or approving the sample slide, read docs/outline-style-and-sample.md.
  • Generate exactly one representative sample after outline, style, and backend are confirmed. Do not generate the full deck until approved.
  • After approval, record sample_generation_method in deck_spec.json so jobs and subagents inherit the same path.
  1. Create the project directory.
  • Before initializing folders or assembling files, read docs/project-assembly-and-reporting.md.
  • If no destination is specified, use the current working directory or the source file directory.
  1. Prepare user-supplied assets.
  • Before using paper figures, charts, screenshots, logos, or other required assets, read docs/user-supplied-assets.md.
  • Treat required assets as strict inputs and confirm slide-to-asset mapping before generation.
  1. Generate all slide images.
  • Before full-deck image generation, read docs/slide-generation-and-subagents.md.
  • Create per-slide jobs with scripts/prepare_slide_prompts.py or saved prompts/slide_XX.json files.
  • Every final image must come from the selected backend and be recorded with bundled state scripts.
  1. Dispatch slide subagents.
  • Before dispatching or replacing slide workers, read docs/slide-generation-and-subagents.md and prompts/slide-worker.md.
  • Use one subagent per remaining slide job whenever possible. If required subagents cannot be spawned, stop and report a blocker unless the user changes the workflow.
  1. Quality check and repair.
  • Before QA or assembly, read docs/project-assembly-and-reporting.md.
  • Inspect every slide before assembly: text, outline match, truncation, style, unwanted page numbers, overlaps, and required assets.
  • Regenerate severe failures with a tighter prompt. Use backend editing for localized issues when available.
  • For CLI/API fallback edit commands, read docs/cli-api-fallback.md. Replace the final slide only after validating the edited output.
  1. Write speaker notes and assemble the PPT.
  • Before writing speech.md or running assembly, read docs/project-assembly-and-reporting.md.
  • Make sure outline.md reflects the final confirmed deck outline. Use speech.md headings that map to Slide N.
  • Before assembly, ensure slide_jobs.json shows generated slides as recorded and approved samples as accepted. If any slide is pending, dispatched, or blocked, stop.
  1. Report the result.
  • Use the final report checklist in docs/project-assembly-and-reporting.md.
  • Include paths, slide count, backend used, recorded-result status, and any limitations or blockers.
  1. Save reusable styles.
  • If asked to save the current deck style or a supplied image/PDF/PPT/PPTX style, read docs/style-library.md.
  • If the final deck used a custom or adapted style, proactively offer to save it in the final report, per docs/project-assembly-and-reporting.md. User custom styles are stored in ${CODEX_PPT_HOME:-~/.codex-ppt-skill}/references/, outside the skill install.

Subagent Dispatch

Slide subagents are mandatory after sample approval whenever the runtime can spawn them. The main agent prepares jobs and records state; each worker handles exactly one prompts/slide_XX.json job and returns only selected image path, backend, and QA note.

Use docs/slide-generation-and-subagents.md for dispatch, commands, result recording, blockers, and backend provenance. Use prompts/slide-worker.md as the handoff template.

Subagents must not edit outline.md, deck_spec.json, other slide jobs, origin_image/, speech.md, or the final .pptx. The parent records outputs and assembles.

Acceptance Criteria

  • Output is a valid .pptx.
  • Each expected final slide image exists under origin_image/slide_XX.png.
  • Every final slide image was generated by the confirmed backend and recorded through record_slide_result.py, except an approved sample marked accepted by run state.
  • outline.md reflects the approved deck outline.
  • speech.md exists when speaker notes are expected, and assembly writes those notes into the PPT.
  • slide_jobs.json and slide_run_state.json reflect the final state.
  • Required source images are visibly represented, or a blocker is reported.
  • If blocked, the final response identifies phase, slide id, evidence path, and unfinished reason; do not call the deck complete.

Reference Map

  • docs/workflow-gates-and-progress.md: approval gates, progress, completion evidence.
  • docs/backend-selection.md: backend decision rules and confirmation text.
  • docs/outline-style-and-sample.md: outline, style, sample rules, prompt examples.
  • docs/user-supplied-assets.md: strict handling for required source assets.
  • docs/slide-generation-and-subagents.md: jobs, dispatch, result recording, blockers, provenance.
  • docs/cli-api-fallback.md: fallback runtime, generation/edit commands, image limits, troubleshooting.
  • docs/image-model-configuration.md: API key, base URL, model, .env; read only when config is needed.
  • docs/project-assembly-and-reporting.md: project directory, notes, assembly, final report, prompting principles.
  • prompts/slide-worker.md: slide subagent handoff template.
  • references/*.md: built-in visual style references. User custom styles live in ${CODEX_PPT_HOME:-~/.codex-ppt-skill}/references/ and take priority over built-in styles with the same name.

Documentation and Updates

For source, docs, install, config, and examples, see ningzimu/codex-ppt-skill.

想直接用这个技能?

本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。

它属于哪个仓库

星标★ 5,947
本站分层T2
该仓技能数1
原文件路径skills/codex-ppt/SKILL.md