Image to Editable PPT Slide

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:42 AM UTC
• Version: 1.0.0

Overview

The skill mostly performs local PowerPoint generation, but it also tells agents to commit workspace changes automatically, which can alter repository history without clear user approval.

Install only if you are comfortable reviewing its actions closely. Use it in a clean workspace or explicitly tell the agent not to create git commits unless you approve the exact files to stage and commit. The local PPTX helpers themselves appear purpose-aligned and do not show network, credential, or exfiltration behavior.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:30

Finding

Unrequested Repository Modification Through Mandatory Commits

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 30
Vulnerability Type: Unauthorized repository state modification
Risk Level: Medium

Vulnerable Code Snippet

markdown

- Commit updates in the workspace after edits

Technical Analysis

The skill unconditionally instructs the agent to commit workspace changes after editing. Creating an editable PowerPoint presentation only requires reading source material and writing the requested output files; modifying version-control history is not necessary for that task.

Because the instruction does not require explicit user approval, constrain the commit to files generated by the skill, or require review of staged changes, an autonomously invoked agent could create a persistent repository commit that includes unrelated pre-existing modifications or sensitive files. This violates least-privilege principles by directing the agent to perform a repository-level write beyond the legitimate needs of slide generation.

Attack Path

1. A user requests conversion of an image into an editable PowerPoint presentation.
2. The agent autonomously loads this skill based on its matching description.
3. The agent reads the source material and creates the PPTX, JSON specification, or generator script in a repository workspace.
4. Unrelated modified or staged files already exist in that workspace.
5. The skill's unconditional instruction causes the agent to create a commit without obtaining separate user authorization or confirming the exact file set.
6. Unrelated or sensitive changes may consequently be recorded in persistent repository history.

Impact Assessment

Successful exploitation or accidental activation could:

• Create commits without the user's informed approval.
• Persist generated or unrelated workspace changes in repository history.
• Include unrelated staged files or sensitive local material in a commit.
• Disrupt the user's expected version-control workflow.
• Increase the risk of ...[truncated 347 chars]

Remediation

View remediation

Remediation Suggestions

Remove the unconditional commit requirement from the skill's core rules. PowerPoint generation should finish after writing the files requested by the user.

If optional version-control integration is retained:

1. Require explicit user approval immediately before creating a commit.
2. Display the exact files and changes proposed for staging.
3. Stage only files generated or modified for the current task; never use broad commands such as git add . or git add -A.
4. Detect and exclude pre-existing staged or unstaged changes.
5. Allow the user to review and approve the commit message.
6. Do not push the commit unless the user separately and explicitly requests remote publication.
7. Treat refusal or absence of approval as a requirement to leave repository history unchanged.

A safer replacement would be:

markdown

- Do not create commits or modify repository history unless the user explicitly requests it.
- If a commit is requested, show the exact task-related files first and obtain approval before staging or committing them.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill explicitly instructs reading local reference images and writing PPTX, JSON, and helper script files, but it does not declare any tool scope such as permissions or allowed-tools. That creates a capability/permission mismatch where an agent may exercise file read/write behavior without an explicit, reviewable boundary, increasing the risk of unintended access to sensitive local files or modification of workspace contents.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The manifest describes a skill specifically for rebuilding reference images into visually matching editable slides. The module docstring instead says the goal is 'not to auto-trace an image' and presents the code as a reusable JSON-driven editable-slide builder, which is broader and differently scoped than the manifest’s image-conversion positioning.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 74% confidence

Finding

The inline documentation says the goal is 'not to auto-trace an image,' while the skill manifest says the skill is for rebuilding reference images as editable PowerPoint slides. Although the code itself is a local renderer, this documentation creates an intent-level contradiction about whether image-based reconstruction is part of the skill’s purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.