T08 · Insecure Dependencies
Warning
- Location
SKILL.md:237- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
Cjl Slides
Security checks for vulnerabilities and agentic risk
Overview
This slide-generation skill is mostly coherent, but it includes an optional Vercel deployment step that runs an unbundled local shell script and could publish presentation content externally.
Install only if you are comfortable reviewing or disabling the deployment step. Do not run the Vercel deployment command unless you have inspected the actual deploy.sh file, confirmed what will be published, and verified that the presentation contains no confidential material. Use a virtual environment and pinned dependencies for python-pptx.
Vulnerability Patterns
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T07 · Tool Hijacking and Spoofing
Warning
- Location
SKILL.md:306- Finding
Execution of an Unbundled and Unverified Deployment Script
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description focuses on creating styled HTML presentations and optionally exporting them to PowerPoint. This code does not generate presentations, apply any of the 24 styles, enforce fonts or layout rules, or export to .pptx. Instead, it parses an input PowerPoint file and extracts its contents into JSON plus image files. While the description briefly mentions uploading .pptx for conversion, this code alone is only an extraction/import step and its primary behavior is materially different from the declared end-user purpose. Therefore this is a clear description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a full presentation authoring skill focused on generating stunning HTML slides in 24 predefined visual styles with strict design constraints, offline HTML/CSS/JS tooling, and optional PPTX export. The supplied code chunk does not implement that primary purpose. It only performs one narrow function: converting an existing HTML file into a PPTX file. It parses inline styles, adds text boxes and images to PowerPoint, and preserves some colors/fonts/layout values approximately. There is no logic for generating slides from user content, no style catalog, no design-rule enforcement, no font whitelist checks, no browsing or selecting among 24 styles, and no JS/HTML authoring environment. Additionally, the description claims zero external dependencies, but the code depends on python-pptx, lxml, and standard file I/O. While PPTX export is mentioned in the description, this code represents only a subset utility and not the described end-to-end skill, so the description materially overstates and misrepresents the behavior.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest states the skill has 'Zero external dependencies: pure HTML/CSS/JS, works offline' at L011, but elsewhere the same file requires loading Chart.js from cdnjs/jsdelivr for chart slides and offers deployment to Vercel. Those are not merely implementation details of local HTML slide generation; they materially expand the described behavior beyond offline, zero-dependency operation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The activation section says the skill should activate for generic requests like creating a presentation, generating slides, or when a user provides content needing a visually polished HTML page. These triggers are broad enough to match many ordinary requests and do not clearly distinguish when this specific skill should activate versus other writing, document, or presentation helpers.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest description focuses on creating HTML presentations and exporting to .pptx, yet L304-L306 adds an additional deployment capability via a shell script to Vercel. Deployment is a distinct operational capability not implied by presentation generation or file conversion alone.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Allowing execution of a deployment shell script from a slide-generation skill introduces an unnecessary high-impact capability: publishing user content to a third-party hosting platform. If triggered carelessly, this can expose confidential presentation content, credentials, or internal materials, and the skill text does not require sufficiently explicit safety checks before making content public.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill permits deployment through a shell script without a strong user-facing warning that this may execute commands and publish files externally. That combination creates a real risk of unintended exposure of sensitive materials and unsafe command execution expectations, especially in an agent setting where users may not realize 'deploy' means public hosting.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown file presents all user-facing content in Chinese and does not indicate that other languages are available or that Chinese is optional. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code file contains natural-language documentation in Chinese only, including the description and usage text. Under the stated policy, forcing a specific language without user opt-in is a locale/language policy violation because users are not offered an alternative language or choice.
- Content