ClawHub
Back to skill

Security audit

ai-ppt-powerpoint-generator

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it sends user content to external services and documents an unpinned CLI execution path with insufficient privacy and scope warnings.

Review before installing. Use this only with non-sensitive prompts and images unless you accept third-party processing and shareable remote workspaces. Prefer the documented direct API call over the unpinned `npx` command, or pin and isolate the CLI with only the needed API key. Do not use the unrelated photo-editing or watermark-removal capability unless you have rights to the media and understand the service terms.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:588
Finding

Unpinned Third-Party Package Execution Through npx

Content
View full analysis
Remediation
View remediation
agent ... ``` Do not use version ranges or floating tags such as `latest`. 2. Prefer declaring the package in `package.json`, committing the corresponding lockfile, installing with `npm ci`, and invoking the verified local binary: ```bash npm ci --ignore-scripts ./node_modules/.bin/onekey agent ... ``` 3. Verify the authoritative package name, registry, publisher identity, provenance, and package signatures before documenting it. 4. Enforce lockfile integrity and use an approved registry configuration. Review dependency changes before updating the pinned version. 5. Determine whether installation scripts are required. If they are not, disable them with `--ignore-scripts` to reduce exposure to malicious lifecycle hooks. 6. Run the CLI in a restricted environment or container with minimal filesystem access and no unrelated secrets. Pass only the credential required for the operation. 7. Use a narrowly scoped, revocable API key with usage limits. Rotate the key immediately if an untrusted package version may have been executed. 8. Document the expected package version and checksum so users can verify the retrieved artifact before execution. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest markets the skill narrowly as a PowerPoint/carousel generator, but the documentation reveals it is effectively a general remote design-generation and editing gateway tied to an external workspace service. This mismatch can mislead users and downstream agents about the true scope of data handling, external service usage, and generated artifact exposure, increasing the risk of unintended data disclosure and overbroad invocation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill omits clear notice that user prompts, uploaded images, and generated outputs are transmitted to external services and then exposed through workspace/share URLs. Users may unknowingly submit sensitive or proprietary content that becomes accessible outside the local agent context, creating confidentiality and privacy risks.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The skill directly posts user-supplied content and an access key to an external endpoint, which is expected behavior for a cloud-backed skill but still creates a real data-exposure boundary. In this context, the danger is amplified because the documentation does not pair the transmission with strong warnings about third-party processing, storage, or shareable output links.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

bash
export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key

curl -X POST "https://agent.deepnlp.org/agent_router" \
-H "Content-Type: application/json" \
-H "X-OneKey: $DEEPNLP_ONEKEY_ROUTER_ACCESS" \
-d '{

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documented support for photo editing, including watermark removal, materially exceeds the stated presentation-generation purpose and introduces misuse-prone functionality. Unnecessary high-risk capabilities increase abuse potential, including modification of third-party media or removal of ownership indicators, without clear user justification or safeguards.

Content

No source excerpt is available for this finding.