ClawHub
Back to skill

Security audit

PPT Compressor

Security checks for vulnerabilities and agentic risk

Overview

This skill performs the advertised PPT-to-PDF compression workflow, but it can overwrite and delete a predictable intermediate PPTX file in the chosen output folder.

Review before installing. Use this only on presentations and output folders you control, and avoid output directories containing a file named like the input basename plus '_压缩版.pptx'. Treat sensitive presentations carefully because contents are extracted and transformed locally during conversion, and install LibreOffice only from a trusted source.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/compress.py:190
Finding

Predictable Intermediate Filename Causes Existing File Overwrite and Deletion

Content
View full analysis
_压缩版.pptx` can be overwritten and subsequently removed. The broad exception handler also suppresses cleanup errors, making failures less visible and complicating diagnosis. ### Attack Path 1. An attacker identifies the basename of a PPTX that a user or automated agent is expected to process. 2. The attacker places a valuable file, or causes one to be placed, in the selected output directory under the predictable name `_压缩版.pptx`. 3. The user or agent runs the documented compression command with ...[truncated 997 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill advertises shell and file-reading behavior but does not declare an explicit tool scope such as permissions or allowed-tools. That makes the effective execution boundary unclear to users and to any policy layer, increasing the chance the skill will be run with broader filesystem or command execution access than intended. In this context, the workflow explicitly decompresses archives, rewrites files, and invokes external binaries, so missing scope declarations meaningfully weaken transparency and containment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The usage and workflow omit a clear warning that the process extracts presentation contents, modifies embedded media, repackages the deck, and creates converted output files such as PDFs. Users may supply sensitive presentations without understanding that intermediate files and transformed outputs will be created on disk, which can lead to unintended data exposure, overwrite risk, or retention of confidential content in temporary artifacts. Because this skill handles presentation internals and external conversion tooling, the lack of disclosure makes the behavior more dangerous than a simple read-only utility.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/compress.py (reported line 57)May include surrounding context.

python
ext = os.path.splitext(img_path)[1].lower()
            try:
                if ext in ['.jpeg', '.jpg']:
                    subprocess.run(['sips', '-s', 'format', 'jpeg', '-s', 'formatOptions', '60', img_path, '--out', img_path], 
                                capture_output=True, timeout=30)
                elif ext == '.png':
                    subprocess.run(['sips', '-s', 'format', 'png', '-s', 'formatOptions', '60', img_path, '--out', img_path],

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/compress.py (reported line 60)May include surrounding context.

python
subprocess.run(['sips', '-s', 'format', 'jpeg', '-s', 'formatOptions', '60', img_path, '--out', img_path], 
                                capture_output=True, timeout=30)
                elif ext == '.png':
                    subprocess.run(['sips', '-s', 'format', 'png', '-s', 'formatOptions', '60', img_path, '--out', img_path], 
                                capture_output=True, timeout=30)
                
                new_size = get_file_size(img_path)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/compress.py (reported line 116)May include surrounding context.

python
# 执行转换
    try:
        result = subprocess.run(
            [soffice, '--headless', '--convert-to', 'pdf', '--outdir', output_dir, pptx_path],
            capture_output=True,
            timeout=300

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest says the skill compresses PPT/PPTX file size and repackages the presentation, implying a compressed PPT/PPTX output should be produced. However, after creating the compressed PPTX and using it only as an intermediate for PDF conversion, the script removes it, leaving only the PDF output.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

The module description and later user-facing messages are written entirely in Chinese, which imposes a specific language on users without any opt-in or alternative locale support. The policy explicitly calls out language or locale constraints as violations when they are forced rather than optional or justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.