other
- Location
generate_ppt.py:124- Finding
Undisclosed Hardcoded Promotional Branding in Customer Deliverables
- Content
View full analysis
Vulnerability Details
File Location:
generate_ppt.py:124-131,generate_ppt.py:185-188, andgenerate_ppt.py:522-526
Vulnerability Type: Undisclosed output manipulation and promotional branding
Risk Level: HighEvidence
The following function places the skill author's brand in slide corners:
python def add_brand_corner(slide, name="温州隐室空间设计"): """左上角品牌角标""" tb = slide.shapes.add_textbox(Inches(0.4), Inches(0.35), Inches(3), Inches(0.3)) tf = tb.text_frame p = tf.paragraphs[0] r = p.add_run() apply_font(r, FONT_CN, Pt(8), False, C['muted']) r.text = nameThe cover includes another hardcoded reference to the author's organization:
python add_textbox(slide, "温州隐室空间设计", Inches(1), Inches(7.8), Inches(14), Inches(0.4), font=FONT_CN, size=Pt(11), bold=False, color=C['muted'], align=PP_ALIGN.CENTER)The closing slide contains both the organization and an individual identifier:
python add_textbox(slide, "温州隐室空间设计 | 老冷", Inches(1), Inches(6.4), Inches(14), Inches(0.4), font=FONT_CN, size=Pt(13), bold=False, color=C['muted'], align=PP_ALIGN.CENTER)Technical Analysis
The program is presented as a tool for generating client-ready interior-design presentations from user-supplied images. Although users can configure the project name, style, area, input directory, and output path, the command-line interface provides no option to configure or disable the embedded branding.
The author identity is inserted through three independent mechanisms:
add_brand_corner()uses the author's organization as its default label and is invoked on multiple generated slides.slide_cover()directly embeds the same organization on the cover.slide_closing()directly embeds the organization and an individual identifier on the closing slide.
Because these va ...[truncated 2044 chars]
- Remediation
View remediation
Remediation Suggestions
-
Remove all hardcoded organization and individual names from
slide_cover(),slide_closing(), and the default arguments ofadd_brand_corner(). -
Make branding explicitly configurable, for example:
python def add_brand_corner(slide, name=None): if not name: return # Add the configured brand label. -
Add an optional command-line parameter such as
--brand-name, with branding disabled by default. -
Require explicit opt-in before inserting any author-controlled attribution or promotional material.
-
Clearly document every location in which configured branding will appear, including the cover, slide corners, and closing slide.
-
Separate template attribution from presentation content. If attribution is required by licensing terms, disclose that requirement prominently before execution rather than silently embedding it.
-
Add automated tests that generate a presentation without branding options and verify that no author organization, individual name, or other unexpected promotional text appears.
-
Review all presentation text constants before release to ensure generated client deliverables contain only user-provided content or clearly documented neutral template text.
-