Gamma App API

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:37 AM UTC
• Version: 1.0.1

Overview

This Gamma skill is mostly purpose-aligned, but its shell script can turn crafted presentation text into local Python code execution before sending the API request.

Install only if you are comfortable giving the skill a Gamma API key and sending deck or document content to Gamma. Do not use it with untrusted or confidential prompt text until the script is fixed to pass values to Python as data rather than interpolating them into executable Python source.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/gamma.sh:129

Finding

Arbitrary Python Code Execution Through Generate Command Argument Interpolation

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/gamma.sh:217

Finding

Arbitrary Python Code Execution Through Template Command Argument Interpolation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/gamma.sh (reported line 59)May include surrounding context.

sh

api() {
  local method="$1" endpoint="$2"
  shift 2
  curl -sf -X "$method" "${API_BASE}${endpoint}" \
    -H "X-API-KEY: ${GAMMA_API_KEY}" \
    -H "Content-Type: application/json" \
    -H "accept: application/json" \

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill documents executable shell usage (bash scripts/gamma.sh, curl, python3) but does not declare any explicit tool scope or permissions boundary. That increases the chance the agent can invoke shell capabilities implicitly, making review and enforcement weaker and enabling unintended command execution paths if the skill is triggered or extended unsafely.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list includes broad phrases like 'slides', 'gamma', and 'create a presentation', which are common in normal conversation and can cause unintended invocation. In a skill that performs networked API actions and may consume credits or create externally shared content, accidental activation is more dangerous than in a read-only skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script sends user-provided inputText and related prompt fields directly to Gamma's external API, but provides no explicit notice, consent gate, or redaction step before transmission. In an agent-skill context, users may supply sensitive business, personal, or proprietary content assuming local processing, so silent exfiltration to a third-party SaaS is a real privacy and compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The template command transmits the user prompt and template-related metadata to Gamma's external API without an explicit warning that the content leaves the local environment. Because this skill is specifically for creating presentations/documents from user text, it is reasonably likely to handle confidential drafts, internal strategy, or customer information, making undisclosed external sharing risky.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.