Security audit
Security checks for vulnerabilities and agentic risk
This skill coherently uses Baidu AI to generate PowerPoint files and does not show hidden persistence, credential theft, destructive actions, or unrelated behavior.
Install only if you are comfortable sending PPT topics, generated outline content, and any optional web_content to Baidu AI using your BAIDU_API_KEY. Avoid submitting confidential, regulated, or secret material unless your organization permits Baidu processing.
While description-behavior mismatch alone is often non-security, this variant also notes undeclared access to API credentials/environment and remote theme retrieval. Hidden or understated use of credentials and external calls can undermine user trust and reviewability, especially when the skill markets itself as simple content-based selection but actually performs broader external interactions.
While description-behavior mismatch alone is often non-security, this variant also notes undeclared access to API credentials/environment and remote theme retrieval. Hidden or understated use of credentials and external calls can undermine user trust and reviewability, especially when the skill markets itself as simple content-based selection but actually performs broader external interactions.
While description-behavior mismatch alone is often non-security, this variant also notes undeclared access to API credentials/environment and remote theme retrieval. Hidden or understated use of credentials and external calls can undermine user trust and reviewability, especially when the skill markets itself as simple content-based selection but actually performs broader external interactions.
The skill declares access to environment variables and relies on networked/scripted execution, but it does not declare any explicit tool scope such as permissions or allowed-tools. This weakens the security boundary by making sensitive capabilities like shell execution and API-key use implicit rather than constrained and reviewable.
The skill instructs users to submit PPT topics and potentially content to Baidu AI, but it does not warn that this data will be sent to a third party for processing. This creates a privacy and data-governance risk because users may unknowingly disclose sensitive business, educational, or personal material to an external service.
This request sends the user's query to an external Baidu endpoint to generate an outline, which is an intentional part of the skill's functionality. While not inherently malicious, it is a real data exposure boundary because user input leaves the local environment and may include sensitive business or personal information.
outline = ""
chat_id = ""
query_id = ""
with requests.post(URL_PREFIX + "generate_outline", headers=headers, json=params, stream=True) as response:
for line in response.iter_lines():
line = line.decode('utf-8')
if line and line.startswith("data:"):
The skill transmits user-provided query text, generated outline content, title, and optional web_content to a third-party Baidu service without any explicit disclosure or consent mechanism in the code path. This can expose sensitive or proprietary input if users assume the skill operates locally or are not warned that their content will be sent off-platform.
This call transmits a richer payload externally, including query_id, chat_id, original query, generated outline, title, selected template identifiers, and optional web_content. Because web_content may contain large amounts of copied or sensitive material, this step increases the risk of unintended disclosure to the third-party provider.
"tpl_id": tpl_id,
"web_content": web_content
}
with requests.post(URL_PREFIX + "generate_ppt_by_outline", headers=headers, json=params, stream=True) as response:
if response.status_code != 200:
print(f"request failed, status code is {response.status_code}, error message is {response.text}")
return []
The skill hard-codes category names and later exposes them to users in Chinese, while argument help text and query guidance also require Chinese terms. This creates a language/locale constraint without any opt-in or documented justification, which matches the policy-violation category for forced language use.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
]
start_time = int(time.time())
process = subprocess.Popen(
cmd,
stdout=subprocess.PIPE,
stderr=subprocess.PIPE,
The manifest says the skill generates PPTs with Baidu AI and smart template selection, but it does not mention handling credentials or reading local environment state. Accessing BAIDU_API_KEY is a capability beyond the user-facing purpose, even though it is used to authenticate the external service.
This code sends an authenticated network request to an external Baidu endpoint using the user's API key, but there is no confirmation prompt, user-facing notice, or explanatory comment/docstring describing that external transmission. For code files, outbound network calls that transmit user or system data should have some visible disclosure unless clearly documented as part of the skill's stated purpose.
No suspicious patterns detected.