ClawHub
Back to skill

Security audit

Corespeed Pptx

Security checks for vulnerabilities and agentic risk

Overview

This PPTX skill matches its stated purpose, but it uses an unverified remote installer and runs generated slide code with broad local file read/write access.

Review before installing. Use this only with trusted slide TSX files, avoid running it in directories containing secrets, and prefer installing Deno separately through a trusted package manager. A safer version would pin dependencies, use a lockfile, and scope Deno permissions to the exact input assets and output file.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:10
Finding

Unverified Remote Installer Is Piped Directly into a Shell

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/generate.ts:1
Finding

Dynamically Imported Slide Code Receives Unrestricted Filesystem Permissions

Content
View full analysis
Remediation
View remediation
,` - `--allow-write=` 3. Validate that resolved input and output paths remain within approved directories. 4. Reject output paths that target sensitive files or escape an intended workspace through path traversal or symbolic links. 5. Prefer a declarative, validated presentation format such as JSON over importing executable TSX when handling untrusted or agent-generated content. 6. If executable TSX is required, run generation in a disposable sandbox or container with: - A minimal mounted input directory. - A dedicated writable output directory. - No secrets or host home-directory access. - No network or subprocess capabilities. 7. Remove or revise the shebang so it does not automatically request unrestricted filesystem permissions. ]]>

T08 · Insecure Dependencies

Warning
Location
scripts/deno.json:6
Finding

Remote Dependencies Are Not Protected by a Committed Integrity Lock

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill installs Deno by piping a remotely fetched script directly into the shell, which executes unverified code from the network with the user's privileges. This is especially dangerous in an agent skill because installation may be treated as routine setup, increasing the chance of silent supply-chain compromise, MITM-induced execution, or malicious upstream changes.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md
{
              "id": "deno-install",
              "kind": "shell",
              "command": "curl -fsSL https://deno.land/install.sh | sh",
              "bins": ["deno"],
              "label": "Install Deno (https://deno.land)",
            },

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest description says to use the skill when a user asks to create 'presentations, slide decks, pitch decks, reports, or any PPTX file.' Terms like 'reports' and the broad phrasing around user asks are not narrowly scoped, which could overlap with common requests that do not actually intend PowerPoint generation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The notes state that Deno auto-downloads '@pixel/pptx' from JSR on first run, which implies network activity and retrieval of external code. The document does not clearly warn users up front that first use will contact external services and download dependencies.

Content

No source excerpt is available for this finding.