ClawHub
Back to skill

Security audit

pptx-notes-editor

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward PowerPoint speaker-notes editor, with its main risks coming from normal file modification and mutable optional install commands rather than hidden behavior.

Before installing, prefer the OpenClaw package flow or review the exact SKILL.md you are installing. Avoid running the optional unpinned npx command with elevated privileges, and only let the skill operate on PPTX files you intentionally provide because it will read presentation contents and can modify speaker notes after confirmation.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:37
Finding

Unpinned Third-Party CLI Execution During Installation

Content
View full analysis

Vulnerability Details

File Location: README.md:37
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code

bash
# Or via skills CLI
npx skills add cm8421/pptx-notes-editor

Technical Analysis

The documented installation command invokes the npm-distributed skills CLI through npx without specifying an exact package version or integrity hash. If the package is not already installed locally, npx may retrieve and execute the currently resolved package from the configured npm registry.

Because the executed CLI implementation is outside this repository and is not version-pinned, its behavior can change after this skill has been reviewed. A compromised maintainer account, malicious package release, dependency compromise, registry manipulation, or unexpected package-resolution result could cause attacker-controlled code to run during installation.

This finding applies to the optional README installation method. The audited project itself contains no embedded executable scripts or malicious payloads.

Attack Path

  1. An attacker compromises the resolved skills npm package, one of its executable dependencies, or its publication channel.
  2. The attacker publishes a malicious version that retains plausible CLI behavior while adding an installation-time or runtime payload.
  3. A user follows the README and executes npx skills add cm8421/pptx-notes-editor.
  4. npx resolves and downloads the mutable, unpinned package version.
  5. The malicious package code executes with the privileges and environment of the user running the command.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user's account. Depending on that user's privileges and environment, the payload could read or modify accessible files, steal credentials available to the process, alter agent configuration, install additional componen ...[truncated 308 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the CLI to a reviewed, exact version, for example:
    bash
    npx --yes skills@<audited-version> add cm8421/pptx-notes-editor
  2. Document the expected package publisher, registry, version, and package integrity digest so users can verify what will execute.
  3. Prefer the manual installation method that copies the reviewed SKILL.md without executing an unrelated package.
  4. If a CLI remains recommended, audit and lock its full transitive dependency tree and update the pinned version only through a controlled review process.
  5. Advise users not to run installation commands with administrator or root privileges and to use a restricted environment where possible.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 33)May include surrounding context.

bash
# One-line install (Recommended)
mkdir -p ~/.claude/skills/pptx-notes-editor && curl -fsSL https://raw.githubusercontent.com/cm8421/pptx-notes-editor/main/SKILL.md -o ~/.claude/skills/pptx-notes-editor/SKILL.md

# Or via skills CLI
npx skills add cm8421/pptx-notes-editor

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 107)May include surrounding context.

bash
# One-line install (Recommended)
mkdir -p ~/.claude/skills/pptx-notes-editor && curl -fsSL https://raw.githubusercontent.com/cm8421/pptx-notes-editor/main/SKILL.md -o ~/.claude/skills/pptx-notes-editor/SKILL.md

# Or via skills CLI
npx skills add cm8421/pptx-notes-editor

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 33)May include surrounding context.

bash
# One-line install (Recommended)
mkdir -p ~/.claude/skills/pptx-notes-editor && curl -fsSL https://raw.githubusercontent.com/cm8421/pptx-notes-editor/main/SKILL.md -o ~/.claude/skills/pptx-notes-editor/SKILL.md

# Or via skills CLI
npx skills add cm8421/pptx-notes-editor

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 107)May include surrounding context.

bash
# One-line install (Recommended)
mkdir -p ~/.claude/skills/pptx-notes-editor && curl -fsSL https://raw.githubusercontent.com/cm8421/pptx-notes-editor/main/SKILL.md -o ~/.claude/skills/pptx-notes-editor/SKILL.md

# Or via skills CLI
npx skills add cm8421/pptx-notes-editor

Session Persistence

Medium
Category
Rogue Agent
Confidence
76% confidence
Finding

The recommended install command writes the skill persistently into ~/.claude/skills/pptx-notes-editor, causing future agent sessions to load behavior fetched from a remote source. Persistent installation is not inherently malicious, but it increases risk because a one-time command can affect later sessions and trust decisions beyond the original context.

Content

Scanner excerpt · README.md (reported line 33)May include surrounding context.

bash
# One-line install (Recommended)
mkdir -p ~/.claude/skills/pptx-notes-editor && curl -fsSL https://raw.githubusercontent.com/cm8421/pptx-notes-editor/main/SKILL.md -o ~/.claude/skills/pptx-notes-editor/SKILL.md

# Or via skills CLI
npx skills add cm8421/pptx-notes-editor

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The README instructs users to run npx skills add cm8421/pptx-notes-editor without pinning an exact version or immutable source. That creates a supply-chain risk: future changes to the package or a compromised publishing account could cause users to install unexpected code or a different skill version than the one reviewed.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The usage examples are broad natural-language triggers such as 'Help me edit the speaker notes in my-presentation.pptx', which may cause an agent to activate the skill in contexts the user did not precisely scope. In agent ecosystems, ambiguous activation language can increase the chance of unintended file access or modification workflows being invoked automatically.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.