ClawHub
Back to skill

Security audit

slidesmith

Security checks for vulnerabilities and agentic risk

Overview

This skill is a documented Google Slides editing workflow whose remote write and credential behaviors are disclosed and aligned with its purpose, though users should be careful before pushing changes to live decks.

Install only if you want agents to edit real Google Slides decks through the slidesmith CLI. Require explicit confirmation before any push, replace-image, reorder, group, or theme-apply operation on an existing deck, prefer dry-run or diff first, and avoid the insecure credential fallback unless you understand the temporary risk.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The skill prominently describes pulling, diffing, and pushing changes to the same live Google Slides deck, but the opening behavior description does not foreground a strong user warning that pushes modify a real remote document in place. In an agent setting, that increases the chance of unintended destructive or surprising edits to production decks when a user may expect a draft or export workflow.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The documentation states that `replace-image` pushes immediately with a revision lock and is not staged by the normal `diff`/`push` loop. Because this bypasses the normal preview workflow, an agent could make immediate remote changes without the user realizing the command is write-through.

Credential Access

High
Category
Privilege Escalation
Content
`GOG_ACCESS_TOKEN` / `gog auth credentials <file> --insecure` as a fallback.
In a non-interactive process, keyring calls time out after 5 seconds instead of
hanging on a Keychain prompt, and session-token operations fall back to the
0600 file store. Set `SLIDESMITH_KEYRING_TIMEOUT=<float-seconds>` to override
that bound, or `SLIDESMITH_KEYRING_TIMEOUT=0` to disable all keyring access;
`SLIDESMITH_TOKEN_STORE=file` selects only the session store, not gogcli's
bounded client-secret lookup.
Confidence
78% confidence
Finding
The documentation suggests using `GOG_ACCESS_TOKEN` or `gog auth credentials <file> --insecure` as a fallback. While environment variables and insecure credential-loading modes can be operationally useful, explicitly recommending an `--insecure` path in a skill can normalize weaker secret-handling practices and increase the chance that agents or operators use less-protected credential material.

Static analysis

No suspicious patterns detected.