Corespeed Pptx

• Outcome: Review
• Latest audit: Sep 14, 2026 · 9:06 PM UTC
• Version: 0.0.1

Overview

This PPTX skill matches its stated purpose, but it uses an unverified remote installer and runs generated slide code with broad local file read/write access.

Review before installing. Use this only with trusted slide TSX files, avoid running it in directories containing secrets, and prefer installing Deno separately through a trusted package manager. A safer version would pin dependencies, use a lockfile, and scope Deno permissions to the exact input assets and output file.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:10
• Finding: Unverified Remote Installer Is Piped Directly into a Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 10–20 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```json "openclaw": { "emoji": "📊", "requires": { "bins": ["deno"] }, "install": [ { "id": "deno-install", "kind": "shell", "command": "curl -fsSL https://deno.land/install.sh | sh", "bins": ["deno"], "label": "Install Deno (https://deno.land)", }, ], }, ``` ### Technical Analysis The installation command downloads mutable content from an external URL and immediately sends it to `sh`. There is no fixed artifact version, checksum validation, digital-signature verification, or opportunity to inspect the downloaded script before execution. HTTPS protects the transfer in transit but does not establish that all future content served from the URL will remain identical to the content reviewed during this audit. Compromise of the distribution endpoint, publisher infrastructure, DNS/TLS trust chain, or upstream installer could consequently change the effective code executed by the Skill. Installing Deno is relevant to the declared presentation-generation functionality, but executing an unverified remote script is not the minimum-privilege or minimum-risk installation mechanism. ### Attack Path 1. A user or agent installs the Skill on a system without Deno. 2. The installation framework invokes the declared shell command. 3. `curl` retrieves the current contents of `https://deno.land/install.sh`. 4. The response is passed directly to `sh` without integrity verification. 5. If the response has been maliciously altered, arbitrary shell commands execute with the privileges of the account installing the Skill. 6. Those commands can access, alter, or delete any resource available to that account and may modify shell initialization files or install additional components. ### Impact Assessment ...[truncated 563 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the automatic `curl | sh` installation command and require Deno to be installed separately through a trusted platform package manager. 2. If automated installation is necessary: - Pin a specific Deno release and artifact URL. - Download the artifact to a file rather than piping it into a shell. - Verify a hardcoded cryptographic checksum or publisher-provided digital signature. - Abort installation if verification fails. - Execute only the verified artifact. 3. Avoid running installation as root or through `sudo`. 4. Document all files and shell configuration entries the installer may modify. 5. Prefer an installation framework that records artifact provenance and supports reproducible, integrity-checked packages. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/generate.ts:1
• Finding: Dynamically Imported Slide Code Receives Unrestricted Filesystem Permissions<![CDATA[ ## Vulnerability Details **File Location**: `scripts/generate.ts`, lines 1–8 and 32–42; invocation documented in `SKILL.md`, line 27 **Vulnerability Type**: Excessive filesystem privileges for dynamically executed code **Risk Level**: Medium ### Vulnerable Code ```ts #!/usr/bin/env -S deno run --allow-read --allow-write /** * PPTX generator wrapper. * * Takes a .tsx slide file path and output .pptx path as arguments. * The .tsx file must export a `deck` variable (the JSX Presentation element). * * Usage: * deno run --allow-read --allow-write generate.ts slides.tsx output.pptx [--json] */ ``` ```ts try { const mod = await import(`file://${inputPath}`); if (!mod.deck) { const msg = `Error: ${inputFile} must export a "deck" variable`; if (jsonMode) { console.log(JSON.stringify({ ok: false, error: msg })); } else { console.error(msg); } Deno.exit(1); } const pptxBytes = generate(mod.deck); Deno.writeFileSync(outputPath, pptxBytes); ``` The documented invocation is: ```bash deno run --allow-read --allow-write --config {baseDir}/scripts/deno.json {baseDir}/scripts/generate.ts slides.tsx output.pptx [--json] ``` ### Technical Analysis The generator does not parse the supplied TSX as passive presentation data. It dynamically imports the file as a Deno module. Importing a module executes its top-level code before the exported `deck` is inspected. The runtime command grants unrestricted `--allow-read` and `--allow-write` permissions. These permissions are inherited by the imported slide module and are not limited to the input file, referenced presentation assets, or requested output file. A malicious or externally influenced TSX file can therefore use Deno filesystem APIs to read or overwrite any file accessible to the current account. Dynamic module execution is part of the selected architecture, but unrestricted filesystem access exceeds what is minimally required to read presentation inputs and w ...[truncated 1426 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat every TSX input as executable code and explicitly state that only trusted slide modules may be used. 2. Scope Deno permissions to the exact resources needed, for example: - `--allow-read=<input-file>,<approved-asset-directory>` - `--allow-write=<exact-output-file-or-dedicated-output-directory>` 3. Validate that resolved input and output paths remain within approved directories. 4. Reject output paths that target sensitive files or escape an intended workspace through path traversal or symbolic links. 5. Prefer a declarative, validated presentation format such as JSON over importing executable TSX when handling untrusted or agent-generated content. 6. If executable TSX is required, run generation in a disposable sandbox or container with: - A minimal mounted input directory. - A dedicated writable output directory. - No secrets or host home-directory access. - No network or subprocess capabilities. 7. Remove or revise the shebang so it does not automatically request unrestricted filesystem permissions. ]]>

T08 · Insecure Dependencies

Warning

• Location: scripts/deno.json:6
• Finding: Remote Dependencies Are Not Protected by a Committed Integrity Lock<![CDATA[ ## Vulnerability Details **File Location**: `scripts/deno.json`, lines 6–7; `scripts/generate.ts`, lines 12–13 **Vulnerability Type**: Insufficient dependency pinning and integrity enforcement **Risk Level**: Medium ### Vulnerable Code ```json { "compilerOptions": { "jsx": "react-jsx", "jsxImportSource": "@pixel/pptx" }, "imports": { "@pixel/pptx": "jsr:@pixel/pptx@0.15", "@pixel/pptx/jsx-runtime": "jsr:@pixel/pptx@0.15/jsx-runtime" } } ``` ```ts import { generate } from "@pixel/pptx"; import { resolve } from "https://deno.land/std@0.224.0/path/mod.ts"; ``` The usage documentation also states: ```markdown - **No manual setup required.** Deno auto-downloads `@pixel/pptx` from JSR on first run. ``` ### Technical Analysis The project imports code from JSR and `deno.land`, but the audited directory contains no lockfile recording the resolved dependency graph and integrity hashes. The `@pixel/pptx` mapping uses the `@0.15` release line rather than an exact patch release. The standard-library URL contains a version tag, but the project still lacks a committed integrity record for the retrieved module and its transitive dependencies. Consequently, first execution can retrieve executable dependency code that is not represented in the reviewed project files. Dependency publisher compromise, registry compromise, unsafe version resolution, or a malicious future release within an accepted version range could change code executed by the generator. This finding does not establish that `@pixel/pptx` or Deno's standard library is currently malicious. It identifies missing reproducibility and integrity controls around remotely downloaded code. ### Attack Path 1. An attacker compromises a dependency publisher account, registry, distribution endpoint, or an accepted dependency release. 2. The host runs the generator without the required modules already present in its cache. 3. Deno resolves and downloads the affected remote dependency. ...[truncated 970 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `@pixel/pptx` to an exact reviewed version rather than the broader `@0.15` release line. 2. Generate and commit a Deno lockfile containing integrity hashes for all direct and transitive dependencies. 3. Require frozen or locked dependency resolution during normal execution so unexpected dependency changes cause failure. 4. Pin every URL import to an immutable reviewed version and include it in lockfile integrity verification. 5. Review dependency updates explicitly and regenerate the lockfile only as part of a controlled update process. 6. Consider vendoring audited dependencies where deployment requirements justify stronger reproducibility. 7. Combine dependency integrity controls with narrowly scoped filesystem permissions so a compromised package cannot access the entire user filesystem. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

External Script Fetching

High

• Category: Supply Chain

Content

{
              "id": "deno-install",
              "kind": "shell",
              "command": "curl -fsSL https://deno.land/install.sh | sh",
              "bins": ["deno"],
              "label": "Install Deno (https://deno.land)",
            },

• Confidence: 98% confidence
• Finding: The skill installs Deno by piping a remotely fetched script directly into the shell, which executes unverified code from the network with the user's privileges. This is especially dangerous in an agent skill because installation may be treated as routine setup, increasing the chance of silent supply-chain compromise, MITM-induced execution, or malicious upstream changes.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The manifest description says to use the skill when a user asks to create 'presentations, slide decks, pitch decks, reports, or any PPTX file.' Terms like 'reports' and the broad phrasing around user asks are not narrowly scoped, which could overlap with common requests that do not actually intend PowerPoint generation.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The notes state that Deno auto-downloads '@pixel/pptx' from JSR on first run, which implies network activity and retrieval of external code. The document does not clearly warn users up front that first use will contact external services and download dependencies.

Static analysis

No suspicious patterns detected.