T08 · Insecure Dependencies
Error
- Location
PLATFORM_COMPATIBILITY.en.md:163- Finding
Unverified Mutable Repository Installed into Trusted Agent Skill Directories
- Content
View full analysis
- Remediation
View remediation
Security audit
CyberPPT (Multi-Platform)
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to be a real presentation-generation workflow, but its install and update instructions trust mutable, unverified downloads and active agent skill directories.
Review the package before enabling it. Prefer an immutable release or reviewed commit, verify hashes or signatures, avoid installing directly from main, do not use git pull as an automatic update path, install dependencies in an isolated virtual environment, and avoid the plaintext HTTP Poppler download path.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T08 · Insecure Dependencies
Error
- Location
PLATFORM_COMPATIBILITY.en.md:431- Finding
Unverified Updates Pull Mutable Upstream Instructions into an Active Skill
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
requirements.txt:7- Finding
Open-Ended Python Dependency Resolution Without Hash Verification
- Content
View full analysis
=0.6.21 Pillow>=10.0.0 PyYAML>=6.0 ``` ```text opencv-python>=4.8.0 numpy>=1.24.0 PyPDF2>=3.0.0 pdf2image>=1.16.0 python-docx>=0.8.11 openpyxl>=3.1.0 matplotlib>=3.7.0 plotly>=5.15.0 openai>=1.0.0 anthropic>=0.18.0 ``` ```bash pip install -r requirements.txt ``` ```bash pip install --upgrade -r requirements.txt ``` ### Technical Analysis All declared packages use open-ended minimum-version constraints. Consequently, installation can resolve to dependency versions that did not exist when the Skill was reviewed. No lock file, exact version pins, artifact hashes, or `--require-hashes` control is provided. The upgrade instruction further encourages replacement with the latest compatible artifacts. If a dependency, transitive dependency, package-index account, or distribution artifact is compromised, installation may execute unreviewed package installation logic or introduce malicious runtime behavior. The file is also formatted as documentation containing Markdown headings, prose, and fenced code blocks rather than as a conventional machine-readable pip requirements file. This can cause installation failures or inconsistent operator workarounds, weakening reproducibility and making it unclear which dependency set is authoritative. ### Attack Path 1. A package maintainer account, package-index entry, release artifact, or transitive dependency is compromised. 2. A malicious version satisfying an open-ended `>=` constraint is published. 3. A user runs one of the documented pip installation or upgrade commands. 4. Pip resolves and downloads the affected version. 5. Malicious installation or runtime code executes with the privilege ...[truncated 635 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
requirements.txt:113- Finding
Native Poppler Dependency Is Referenced Through Plaintext HTTP Without Integrity Verification
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (66)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description presents a broad AI presentation-generation skill with document ingestion, slide creation, quality gating, and multi-platform model support. The supplied code chunk instead implements a narrow build/validation tool for CyberPPT blueprint component signatures. It reads local files, validates required component fields, hashes files, and emits a JSON signature. This is materially different from the declared primary purpose and lacks the core advertised capabilities such as AI-driven presentation generation, source document transformation, PPTX output, or platform integrations. While the code may be part of a larger presentation pipeline, this chunk by itself is not accurately represented by the declared description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents the skill as a full presentation-generation system that converts source documents into consulting-style PPTX decks with evidence and QA capabilities. The supplied code chunk, however, implements only a narrow reporting utility: it reads a JSON QA/compare report and produces a markdown-style rework summary. While this may be a supporting component of a broader PowerPoint QA workflow, the code shown does not itself perform the core declared functionality and instead has a materially different immediate purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description presents the skill as a broad AI presentation-generation system that transforms documents into editable PPTX decks with evidence-based consulting outputs and multiple platform integrations. The supplied code chunk does not implement any document ingestion, AI generation, PPTX creation, evidence-chain handling, or cross-platform agent support. Instead, it performs a narrow visual QA task: loading PNG renders, comparing approved and merged versions via mean absolute pixel difference, and outputting a JSON report. While visual QA could be a supporting component of a presentation pipeline, this code chunk by itself is materially different in primary purpose and capabilities from the declared description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a broad AI skill for transforming documents into consulting-style PPTX decks with evidence and QA across multiple agent platforms. The supplied code chunk does not implement document ingestion, AI generation, evidence handling, editing workflows, or platform support. Instead, it is a focused QA/helper script that inspects an existing PPTX's internal XML to count objects and detect large slide-covering images. While this could be a supporting visual-QA component within a larger presentation pipeline, the code chunk by itself materially differs from the declared primary purpose and lacks the main advertised capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description presents a broad AI skill for generating high-density, evidence-based PPTX presentations from various document types across multiple platforms. The supplied code chunk instead implements a narrow measurement/validation script for blueprint imagery and manual annotations. It requires a PNG blueprint, optionally consumes annotation JSON, calculates scaling to a fixed PowerPoint canvas, and emits a visual element registry JSON. While this could be a supporting component in a presentation-generation pipeline, its actual primary purpose is materially different from the declared end-user capability and omits the core advertised functions such as document ingestion, slide generation, evidence handling, and platform integration.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description centers on an AI presentation-generation skill that ingests multiple document formats and produces consulting-style PPTX outputs with evidence-based validation and multi-platform agent support. The supplied code instead implements an icon-management helper: it scans SVG files, builds a JSON index, searches icons using tokenized keywords, reads SVG viewBox attributes, and copies chosen icons to another folder. There is no document parsing, no PPTX creation or editing, no AI-agent orchestration, no evidence or QA pipeline, and no platform-specific integration. This is a clear material mismatch in primary purpose and behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The supplied code chunk does not implement document-to-PowerPoint generation, evidence chains, presentation QA, or multi-platform AI agent behavior. Instead, it tests icon-management functionality: scanning icon directories, searching indexed icons, copying a chosen SVG icon, and writing a JSON index. That is a materially different primary purpose from the declared presentation-generation skill, so this is a clear description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description presents a content-generation skill for producing consulting-style PPTX decks from documents. The supplied code does not implement presentation generation, document ingestion, AI workflow execution, evidence chains, or visual QA on slides. Its sole function is to validate YAML configuration files in an agents directory for required fields, quality gates, workflow stages, and consistency across platform configs. While the config fields reference concepts like quality gates and platforms related to the declared system, this code chunk is an internal validation script, not the described end-user skill behavior. Therefore the code’s primary purpose is materially different from the declared purpose.
- Content
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 91% confidence
- Finding
The hidden HTML comment contains operational instructions telling the agent how to reread and act on the file under specific encoding conditions. Hidden instructions are dangerous in agent settings because they create a covert control channel that can influence model behavior outside the visible user-facing workflow, and the wording 'before summarizing or acting' is especially directive.
- Content
md - editable_output --- <!-- ENCODING-GUARD: This file is UTF-8. In Windows PowerShell 5.1, use `Get-Content -Encoding UTF8`; if Chinese text appears garbled, reread with UTF-8 before summarizing or acting. --> # CyberPPT
Unvalidated Output Injection
High
- Category
- Output Handling
- Confidence
- 95% confidence
- Finding
Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.
- Content
python source = Path(temp_dir) / "source.pptx" output = Path(temp_dir) / "report.json" make_pptx(source) result = subprocess.run( [ sys.executable, str(SCRIPT_PATH),
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documented trigger phrases are generic everyday commands such as 'create PPT' and 'generate presentation' without any product-specific qualifier or opt-in boundary. In agent platforms that auto-discover or auto-invoke skills based on natural-language matching, this can cause unintended activation, routing unrelated user requests into this skill, and processing user files or tool actions in a context they did not explicitly choose.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The documented trigger patterns include very generic phrases such as "create PPT", "generate presentation", and "make slides", which can easily match ordinary user requests unrelated to an explicit desire to invoke this skill. In an agent ecosystem, broad auto-trigger phrases can cause unintended skill activation, leading the agent to process user files, run skill workflows, or steer outputs in ways the user did not clearly request.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger patterns include very broad everyday phrases such as '做PPT', '生成演示文稿', and '制作幻灯片', which can match many benign user requests unrelated to this specific skill. In an agent ecosystem, overly generic activation criteria can cause unintended routing into the skill, exposing user documents to a more complex workflow than expected and increasing the chance of unauthorized or surprising execution.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill instructs the agent to read/write files and run shell commands, but the manifest declares no explicit tool scope or permission boundaries. In an agent ecosystem, this creates implicit capability creep: operators may invoke the skill believing it is documentation-only or tightly scoped, while it can actually drive filesystem and shell operations.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases include broad everyday terms like '做PPT' and '生成演示文稿', which can cause the skill to activate in ordinary conversations rather than only with clear opt-in. In a skill that may read files, write outputs, and invoke tools, overbroad activation increases the chance of unintended execution on sensitive user content.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill mandates automatic language determination for deliverables without a clear user opt-in, which can silently alter output language and content handling. In document-processing workflows, implicit transformation choices can mis-handle multilingual or sensitive material and may cause incorrect disclosure, misrouting, or compliance issues in the generated artifacts.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger patterns include generic phrases such as '做PPT', '生成演示文稿', '制作幻灯片', 'create PPT', and 'generate presentation', which are likely to match ordinary user requests unrelated to this specific skill. In an agent-routing context, this can cause unintended activation of a high-capability document-processing skill, increasing the chance of prompt collisions, misrouting, and unauthorized handling of user files or tasks.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger patterns are broad and include common phrases such as '做PPT', '生成演示文稿', 'create PPT', and 'generate presentation'. In a multi-skill environment, this can cause unintended or overly eager invocation of this skill on ordinary user requests, potentially routing sensitive documents into this workflow without explicit user intent and increasing the chance of data exposure or unsafe automation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger patterns include broad, everyday phrases such as '做PPT', '生成演示文稿', and '制作幻灯片' that are likely to appear in normal conversation. This can cause unintended skill activation, leading the agent to process user files or enter a complex presentation-generation workflow when the user did not explicitly intend to invoke this skill.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The English triggers 'create PPT' and 'generate presentation' are generic phrases with no scope restriction, making accidental invocation likely in multilingual or mixed-command environments. In this skill, unintended activation is more concerning because the workflow supports document transformation, orchestration, retries, and long timeouts, which could consume resources and process sensitive inputs without clear user intent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger patterns are broad generic phrases such as '做PPT', '生成演示文稿', 'create PPT', and 'generate presentation', which can match ordinary user requests that are not specifically intended to invoke this skill. In an agent ecosystem, this can cause unintended routing to a high-capability skill with file handling, code interpreter access, and asset generation enabled, increasing the chance of over-collection of user files, unexpected tool execution, or incorrect task takeover.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The display text and default prompt steer the interaction into Chinese output without an explicit user preference, which can cause language mismatches and misinterpretation of user intent. While this is not a direct code-execution issue, it can reduce transparency, surprise users, and in enterprise settings contribute to incorrect outputs or mishandling of content when language expectations matter.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger phrase "做PPT" is very broad and can match ordinary user requests unrelated to this specific skill, causing unintended invocation. In a multi-skill agent environment, overly generic activation phrases can override user intent, expand the skill’s access to user-supplied files, and route content into a more capable processing pipeline than the user explicitly chose.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The configured trigger set includes common phrases like "生成演示文稿", "制作幻灯片", "create PPT", and "generate presentation", which are ambiguous and likely to collide with normal conversation. Because this skill supports tool chains, plugins, and pipeline execution, accidental activation is more dangerous here: it may ingest attached documents and perform complex actions without sufficiently clear user selection.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The natural-language description and default prompt are written entirely in Chinese and instruct the skill to generate a specific style of presentation without indicating that the user can choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
- Content
Static analysis
Detected: suspicious.dynamic_code_execution
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- scripts/test_select_icon.py:20
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- scripts/test_validate_pptx.py:23