ClawHub
Back to skill

Security audit

PPT 视觉复刻

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent PPT-replication purpose, but its code can let untrusted model output cause local image files to be embedded in generated presentations.

Install only if you are comfortable with screenshots being sent to a configured VLM service and with local PPTX/image files being read and written. Avoid sensitive slides, use an isolated working directory, and do not share generated PPTX files from adversarial or untrusted source images until image-path validation is added.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/ppt_generator.js:213
Finding

Untrusted VLM Output Can Trigger Arbitrary Local Image File Inclusion

Content
View full analysis

Vulnerability Details

File Location: scripts/coordinate_mapper.js:128-194; scripts/ppt_generator.js:213-220
Vulnerability Type: Unrestricted local file path accepted from untrusted structured input
Risk Level: High

Vulnerable Code

javascript
const regions = Array.isArray(parsed) ? parsed : [parsed];

// Post-processing: field handling without schema enforcement
return regions.map((r, idx) => {
  if (!r.bounds) {
    r.bounds = {
      x: r.x || 0,
      y: r.y || 0,
      width: r.width || r.w || 100,
      height: r.height || r.h || 30
    };
  }

  if (r.content) {
    r.content = normalizeSymbols(r.content, 'keep_cn');
  }

  if (r.content && !r.bulletType) {
    const { bulletChar } = detectBullet(r.content);
    if (bulletChar) r.bulletType = bulletChar;
  }

  if (r.zIndex === undefined) r.zIndex = idx;

  return r;
});
javascript
function renderImage(slide, region, pos) {
  if (region.imagePath || region.path || region.data) {
    slide.addImage({
      ...pos,
      path: region.imagePath || region.path,
      data: region.data  // base64
    });
  }
}

Technical Analysis

Region data originates from an external vision-language model and is therefore outside the application's trust boundary. The parser accepts arbitrary object properties and returns them without enforcing references/region_schema.json, filtering sensitive fields, or validating image paths.

When an accepted region has type image, renderImage passes region.imagePath or region.path directly to pptxgenjs. This permits an untrusted response to select a local file for inclusion in the generated presentation. There is no canonical path resolution, workspace containment check, extension allowlist, file-size restriction, or distinction between application-supplied paths and VLM-supplied paths.

The declared schema does not mitigate the vulnerability ...[truncated 1673 chars]

Remediation
View remediation

Remediation Suggestions

  1. Treat all VLM output as untrusted and validate it against a strict JSON Schema before rendering.
  2. Remove path, imagePath, and data from the set of fields accepted from the VLM. Resolve image references through trusted application-generated identifiers instead.
  3. If local paths must be supported, canonicalize each path with path.resolve and verify that it remains under a dedicated input directory.
  4. Reject absolute paths, traversal components, symbolic links escaping the workspace, device paths, and network-share paths.
  5. Apply an allowlist of supported image extensions and verify file signatures rather than trusting extensions alone.
  6. Enforce limits on individual file size, decoded image dimensions, base64 payload size, and total embedded media.
  7. Configure JSON Schema with additionalProperties: false and explicit constraints for every numerical and string field.
  8. Run conversion in a sandbox with access only to the uploaded source files and a dedicated output directory.
  9. Keep trusted source-image metadata separate from the model response so the model cannot overwrite filesystem references.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:20
Finding

Unpinned Global Installation of a Runtime Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:20
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code

text
npm install -g pptxgenjs

Technical Analysis

The documented installation command does not select an exact audited version of pptxgenjs. npm therefore resolves the package through the registry's current distribution tag at installation time. The code that is ultimately installed can change independently of this Skill's reviewed contents.

The -g option installs the dependency globally rather than isolating it within the project. This broadens the effect of an unexpected or compromised release and can affect other applications that rely on the globally installed command or module. Package installation may also execute npm lifecycle scripts with the permissions of the account performing the installation.

No lockfile, integrity metadata, package manifest, or exact dependency version is included in the audited project.

Attack Path

  1. A user follows the installation instructions.
  2. npm resolves the then-current pptxgenjs release rather than a version reviewed with the Skill.
  3. If the package, one of its transitive dependencies, the relevant registry account, or the distribution tag is compromised, npm downloads the changed package.
  4. Installation lifecycle behavior executes with the installing user's permissions.
  5. The globally installed dependency remains available outside this project and may affect other workflows.

This attack path depends on a future dependency or registry compromise; the audit found no evidence that the current pptxgenjs package is malicious.

Impact Assessment

A compromised dependency could execute code with the privileges of the user running npm, access files available to that account, alter generated presentations, or tamper with local development resources. If a user runs the installatio ...[truncated 222 chars]

Remediation
View remediation

Remediation Suggestions

  1. Add a project-local package.json that pins pptxgenjs to an exact audited version.
  2. Commit a package lockfile containing resolved versions and integrity hashes.
  3. Replace the global installation instruction with a local reproducible command such as npm ci.
  4. Review transitive dependencies and use automated dependency vulnerability scanning.
  5. Avoid running package installation with administrative privileges.
  6. Consider disabling lifecycle scripts during controlled installation where compatible, then explicitly permit only required build steps.
  7. Update dependencies through a documented review process rather than implicitly consuming the registry's latest release.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

At L147, the code calls normalizeSymbols(rawContent, 'keep_cn'), which explicitly enforces a Chinese-preserving normalization mode. This reflects a locale/language preference embedded in the skill without any visible opt-in, fallback, or justification that the tool is limited to a Chinese-only context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

This JSON schema uses Chinese-only natural-language title and description fields, which can amount to a locale/language constraint in a shared skill asset. The file does not indicate that Chinese is optional, user-selected, or justified as a region-specific requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The comments and function contract explicitly define behavior around preserving Chinese full-width punctuation as the default mode (keep_cn), which reflects a locale-specific formatting policy. There is no natural-language indication that users can opt into other locale behaviors, so this can be read as forcing a specific locale convention without user choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.