huashu-data-pro
数据分析与办公提效全能助手。覆盖数据处理、分析洞察、报告撰写、PPT制作、数据可视化的端到端工作流。 始终从专家视角出发，帮用户多想一步。遇到不确定的问题主动与用户确认。 支持：Excel数据分析、投放数据复盘、ROI测算、数据可视化、报告生成、PPT制作、公式生成。 当用户提到"分析数据"、"做报告"、"做PPT"、"Excel"、"投放分析"、"ROI"、"复盘"、 "周报"、"月报"、"数据处理"、"图表"、"可视化"、"汇报"、"表格"、"公式"时使用此技能。
75
92%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
在 references/workflows.md 的“HTML→Playwright截图 / PPT制作”路径中，运行时会通过 scripts/html2pptx.js 对外部传入的 HTML 文件做 page.goto(`file://${filePath}`) 并提取 DOM 文本（extractSlideData）后写入 PPT，因此若 HTML/占位符内容来自不可信的第三方文本输入则存在间接提示注入暴露面。
- Repository
- alchaincyf/huashu-skills
- Commit
35e7cf3
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.