T01 · Skill Instruction Hijacking
Error
- Location
scripts/generate_pptx.py:387- Finding
Unconditional Injection of Third-Party Promotional Contact Information
- Content
View full analysis
- Remediation
View remediation
Security audit
shuzhi-huibao-ppt-generator
Security checks for vulnerabilities and agentic risk
Overview
This PPT skill is mostly a coherent generator, but it automatically inserts the author’s contact information into generated speaker notes.
Review generated PPTX files before sharing, especially the final slide speaker notes, and remove the embedded WeChat/contact credit if it is not desired. Provide only the minimum workplace materials needed, avoid secrets or regulated data, and install dependencies in a pinned virtual environment if you use the script.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:312- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Pillow== ``` 2. Generate and verify cryptographic hashes for all direct and transitive dependencies. Install with a command such as: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Use a reproducible lock-file workflow, such as `pip-tools`, and commit the resulting lock file. 4. Perform installation in a dedicated virtual environment rather than the system Python environment. 5. Document the approved package index and use index configuration that prevents unintended dependency resolution from untrusted repositories. 6. Avoid recommending elevated or administrator-level installation. 7. Scan locked dependencies for known vulnerabilities and review updates before changing pinned versions. 8. Update the import error message to direct users to the locked installation process instead of an unconstrained `pip install` command. ]]>
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The skill's declared behavior emphasizes knowledge-base-driven analysis and a gated workflow, but the detected implementation mainly renders structured JSON, writes an extra report file, and injects an undeclared external contact into speaker notes. This mismatch is dangerous because users and orchestrators may trust the skill with sensitive workplace content under false assumptions about what it actually does and what outputs it produces.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 82% confidence
- Finding
The skill describes file-reading and file-writing behavior via knowledge-base ingestion and PPTX/report generation, but it does not declare any explicit tool scope or permission boundaries. In an agent environment, undeclared file capabilities make it harder to enforce least privilege and can lead to unintended access to sensitive local or workspace materials.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest says the skill triggers automatically '当用户需要制作职场汇报类 PPT 时自动触发', which defines activation by a broad intent category rather than specific invocation phrases or constraints. While the domain is workplace PPTs, the trigger boundary is still ambiguous because it does not state what requests should not activate the skill or provide explicit examples of triggering commands.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The manifest description and the entire skill are written as a Chinese-only workflow for generating workplace PPTs, with no indication that users may choose another language or that the skill is intentionally limited to Chinese-language use cases. This can violate language/locale policy when a skill implicitly forces a specific language without user opt-in.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill explicitly asks for potentially sensitive workplace materials such as meeting notes, leadership requests, project documents, and screenshots, but it does not clearly warn users about the sensitivity of that data or provide handling constraints. In the context of corporate knowledge bases, this increases the risk of over-collection and inappropriate processing of confidential business information.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Automatically appending a personal WeChat contact to the final slide's speaker notes is an unrelated content injection that serves the author, not the user. In workplace presentations, this can leak third-party contact information into deliverables, create unauthorized attribution or advertising, and undermine trust in generated documents.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code embeds multiple fixed Chinese strings in user-visible output, including the default chart placeholder, default conclusion title, report headings, success messages, and generation credit. Because the script presents these strings unconditionally and does not offer a language or locale opt-in, it violates the policy against forcing a specific language without user choice.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script unconditionally appends a hidden promotional credit with a personal contact ("VX：zyc19892233") into the last slide's speaker notes. This modifies user output in a non-user-requested way, leaks unrelated third-party contact information into generated business documents, and can create integrity, privacy, and reputational risk when the PPT is shared externally.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Embedding an unrelated personal promotion/contact string into generated files is a supply-chain style trust violation: users expect a PPT generator to faithfully render their content, not insert unsolicited advertising. In workplace reporting scenarios, hidden notes may later be exposed during review, export, or handoff, causing embarrassment, compliance concerns, or suspicion that the document was tampered with.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The natural-language comment at L002 is entirely in Chinese and provides usage instructions without any opt-in or alternative language. Under the policy rule for language/locale, this can be a locale-specific constraint imposed on users without being documented as region-specific or optional.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file contains only Chinese-language guidance and does not mention that the language is fixed, optional, or intended for a Chinese-speaking audience. Under the language/locale policy, forcing a specific language without user opt-in can be a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This markdown file contains user-facing instructional content exclusively in Chinese, and there is no indication that the language is optional or that alternative locales are supported. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is clearly documented and justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This markdown file contains user-facing instructions entirely in Chinese, and there is no indication that users can opt into another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the language/locale policy, forcing a specific language without user opt-in can be a policy violation.
- Content
Static analysis
No suspicious patterns detected.