CyberPPT (Multi-Platform)

• Outcome: Review
• Latest audit: Jul 23, 2026 · 2:14 AM UTC
• Version: 1.0.0

Overview

This looks like a real PowerPoint-generation skill, but it should go through Review because its broad auto-triggers and dependency hygiene create avoidable risk when handling user documents.

Install only if you are comfortable with this skill processing your source documents and generating local artifacts. Prefer explicit invocation such as "use CyberPPT" instead of generic slide requests, use a virtual environment, upgrade document/image parsing libraries to current patched versions before processing untrusted files, and review generated files before sharing them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (21)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises operational capabilities that include reading files, writing artifacts, and invoking shell commands, but the metadata shown in the skill header does not declare any permissions or capability boundaries. That creates a transparency and governance gap: users or hosting platforms may authorize and execute the skill without understanding that it can access local files and run commands, which increases the risk of unintended data exposure or unsafe command execution in downstream implementations.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The listed trigger phrases are very broad, natural-language commands that users commonly say in many contexts. In a multi-platform skill that can process files and generate outputs, such generic triggers raise the chance of unintended activation, causing accidental execution, unwanted file handling, or invocation during unrelated conversations.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The documented trigger patterns are very broad phrases such as 'create PPT', 'generate presentation', and 'make slides', which are common in normal user conversations and are not scoped to this specific skill. That increases the chance of unintended activation, causing the agent to invoke this skill in contexts the user did not explicitly authorize, potentially exposing uploaded documents or causing unexpected file-processing behavior.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The usage guide repeats the same ambiguous activation keywords and presents them as valid triggers across all platforms without defining boundaries, precedence, or safeguards. In a skill that processes user-supplied documents and produces files, this ambiguity makes accidental invocation more dangerous because ordinary requests about slides may trigger a multi-stage workflow unintentionally.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger patterns listed here are generic everyday phrases such as '做PPT', '生成演示文稿', and '制作幻灯片', which can cause the skill to activate unintentionally during normal user requests. In an agent ecosystem, overly broad activation increases the chance that this skill handles tasks without explicit user intent, potentially exposing uploaded documents or invoking complex workflows unexpectedly.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: This section repeats ambiguous end-user activation guidance using common phrases and examples, reinforcing unsafe auto-trigger behavior across platforms. Because the skill processes user documents and may launch multi-stage generation workflows, accidental invocation can lead to unintended data handling, confusion about agent behavior, and misuse of compute or file-processing capabilities.

Vague Triggers

Medium

• Confidence: 76% confidence
• Finding: The trigger phrases include very broad everyday expressions such as '做PPT' and '生成演示文稿', which can cause the skill to activate in contexts where the user did not intend to invoke this highly prescriptive workflow. In an agent environment with file and shell capabilities, overbroad activation increases the chance of accidental file access, artifact creation, or disruptive workflow takeover.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger phrases include very broad, everyday Chinese requests such as making slides or generating a presentation. This can cause the skill to activate on normal user intent without explicit invocation, increasing the chance of unintended file processing or workflow hijacking in multi-skill environments.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The English triggers 'create PPT' and 'generate presentation' are highly generic and likely to overlap with ordinary assistant requests. In a platform with automatic skill routing, this can unintentionally route common conversations into this skill, causing unexpected behavior, unnecessary document handling, or suppression of safer/default flows.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger list includes very generic phrases such as '做PPT', '生成演示文稿', '制作幻灯片', 'create PPT', and 'generate presentation', which are likely to match ordinary user requests rather than explicit invocation of this specific skill. That can cause unintended activation, routing user content into this skill without clear consent, increasing the chance of accidental file processing, incorrect tool selection, or abuse through prompt shaping of common presentation requests.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger patterns are broad and include generic phrases such as '做PPT', '生成演示文稿', '制作幻灯片', 'create PPT', and 'generate presentation'. In a multi-skill agent environment, this can cause overbroad activation, making the skill intercept ordinary presentation requests unintentionally and process user files without sufficiently specific user intent for this particular high-capability workflow.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger list includes broad phrases such as '做PPT', '生成演示文稿', '制作幻灯片', 'create PPT', and 'generate presentation', which are likely to match ordinary user requests outside the intended specialized CyberPPT workflow. This can cause the skill to activate unexpectedly, capturing general presentation tasks and increasing the chance of unintended tool use or overbroad handling of user-supplied documents.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger phrase "做PPT" is extremely broad and can match ordinary user requests that are not specifically intended to invoke this skill. In an agent environment with automatic or semi-automatic skill routing, this increases the risk of unintended activation on sensitive documents, causing unexpected file processing, data exposure to the skill pipeline, or user-confusing behavior.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The phrases "生成演示文稿" and "制作幻灯片" are generic task descriptions rather than skill-specific invocations, so they are likely to collide with normal user language. In this skill, which accepts multiple document types and can auto-save outputs, ambiguous activation makes unintended processing more dangerous because user files may be transformed or persisted without clear intent to use this particular skill.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The English triggers "create PPT", "generate presentation", and "make slides" are common everyday requests that could match a wide range of benign user intents unrelated to this specific skill. Because the skill is designed to transform uploaded documents into PPTX and supports custom tool integration, broad activation expands the chance of accidental invocation and unnecessary exposure of user content to downstream tooling.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The skill requires the agent to automatically infer and apply a target language based on user input, source material, or conversation context without first obtaining explicit user confirmation. In a document-processing skill, this can cause unintended disclosure, mistranslation, or generation of outputs in a language the user did not authorize, especially when source materials are multilingual or sensitive.

Known Vulnerable Dependency: Pillow==10.0.0 — 10 advisory(ies): CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2024-28219 (Pillow buffer overflow vulnerability); CVE-2026-55379 (Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()`) +7 more

Critical

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: Pillow==10.0.0

Known Vulnerable Dependency: opencv-python==4.8.0 — 2 advisory(ies): GHSA-qr4w-53vh-m672 (opencv-python bundled libwebp binaries in wheels that are vulnerable to CVE-2023); PYSEC-2023-183 (opencv-python versions before v4.8.1.78 bundled libwebp binaries in wheels that )

High

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: opencv-python==4.8.0

Known Vulnerable Dependency: PyPDF2==3.0.0 — 2 advisory(ies): CVE-2023-36464 (pypdf and PyPDF2 possible Infinite Loop when a comment isn't followed by a chara); CVE-2023-36464 (pypdf and PyPDF2 possible Infinite Loop when a comment isn't followed by a chara)

High

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: PyPDF2==3.0.0

Known Vulnerable Dependency: pytest==7.4.0 — 2 advisory(ies): CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)

High

• Category: Supply Chain
• Confidence: 78% confidence
• Finding: pytest==7.4.0

Known Vulnerable Dependency: black==23.0.0 — 5 advisory(ies): CVE-2026-32274 (Black: Arbitrary file writes from unsanitized user input in cache file name); CVE-2024-21503 (Black vulnerable to Regular Expression Denial of Service (ReDoS)); CVE-2024-21503 (Versions of the package black before 24.3.0 are vulnerable to Regular Expression) +2 more

Critical

• Category: Supply Chain
• Confidence: 84% confidence
• Finding: black==23.0.0

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/test_select_icon.py:20

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/test_validate_pptx.py:23