Security audit

html-ppt-skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed HTML slide-deck generator with some broad formatting defaults but no evidence of malicious behavior.

Install this if you want HTML-based slide decks. Be aware it strongly defaults to HTML instead of PPTX, saves generated decks as files, and may load fonts from Google when opened in a browser; ask the agent to use PPTX, local fonts, or a different language/locale when needed.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Hidden Instructions

High

Category: Prompt Injection
Content: ### 方式一：从空白模板开始直接打开 `assets/blank-starter.html`，在 `` 注释下方复制 `.slide` 块即可。 ### 方式二：从设计系统模板开始
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

Category: Prompt Injection
Content: ### 方式一:从空白模板开始直接打开 `assets/blank-starter.html`,在 `` 注释下方复制 `.slide` 块即可。 ### 方式二:从设计系统模板开始
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Vague Triggers

High

Confidence: 96% confidence
Finding: The skill uses mandatory, very broad trigger phrases like '做 PPT' and 'deck' with instructions that it 'must' activate, which can cause the agent to invoke this skill outside the user's intended scope. This creates routing/control risk: presentation-related requests may be force-redirected into HTML file generation even when the user wanted another format or a non-file response.

Natural-Language Policy Violations

Medium

Confidence: 85% confidence
Finding: The README prescribes language-specific typography rules, including dedicated Chinese display/body fonts and a blanket prohibition on common fallback fonts. Because the document does not frame this as optional or limited to a China-specific use case, it can be read as forcing a locale-specific presentation style without user opt-in.

Natural-Language Policy Violations

Medium

Confidence: 81% confidence
Finding: The instructions require selecting matching Chinese fonts and define typography rules around Chinese display/body fonts, while the skill is described as generally handling presentation requests. Because the file does not offer language or locale opt-in or explain that it is limited to Chinese-language decks, it imposes a locale-specific default that may conflict with language-choice policy.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The workflow requires writing output to /mnt/user-data/outputs/ and calling present_files, but it does not instruct the agent to disclose or confirm file creation with the user. Silent persistence to user storage can violate user expectations, create unwanted artifacts, and increase the chance of data handling issues if sensitive content is rendered into saved files.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The document body and usage guidance are written in Chinese and state the design system is intended for reuse by SKILL.md, which can impose a specific language/locale on downstream skill behavior. There is no indication that users may choose another language or that the Chinese-only constraint is required for a region-specific purpose.

Natural-Language Policy Violations

Low

Confidence: 96% confidence
Finding: The document declares `lang="zh-CN"`, which hard-codes a specific language/locale. Under the policy criteria, forcing a locale without user opt-in or clear justification is a natural-language policy concern.

Static analysis

No suspicious patterns detected.