Html Slides To PPTX

• Outcome: Review
• Latest audit: Jul 28, 2026 · 3:03 AM UTC
• Version: 1.0.0

Overview

This is a real HTML-to-PowerPoint slide skill, but it can silently fetch web assets and embed local files referenced by slide HTML, so it should be reviewed before use.

Install only if you trust the slide HTML and asset references being converted. Avoid using this skill on untrusted HTML, review any http(s), file://, video, audio, and image paths before conversion, and expect npm plus a Playwright Chromium download on first use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill invokes external tooling that can access the network and environment (`npm install`, `npx playwright install chromium`, and Node-based scripts), but it declares no corresponding permissions or trust boundaries. This creates a real capability mismatch: running the skill may fetch remote code/dependencies and use environment-derived data without the user or platform having explicit visibility or control over those actions.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The conversion pipeline performs outbound fetches for any http(s) image URL embedded in slide content, which expands a nominally local HTML-to-PPTX workflow into a networked one. This can leak IP/addressing metadata, trigger access to attacker-controlled endpoints, and enable SSRF-like access to internal resources if untrusted HTML supplies image URLs.

Context-Inappropriate Capability

Low

• Confidence: 89% confidence
• Finding: The slide fixture loads fonts from Google Fonts, which introduces an external network dependency into a workflow described as local HTML generation, validation, and conversion. This can leak environment metadata such as IP address and usage timing during rendering, and can also reduce build reproducibility or fail in offline or restricted environments.

Context-Inappropriate Capability

Low

• Confidence: 92% confidence
• Finding: The slide fixture imports Google Fonts from an external CDN, which creates network dependency, potential privacy leakage, and non-deterministic rendering during validation or PPTX conversion. In a workflow described as producing local, self-contained HTML slide assets, this also undermines reproducibility and could fail in offline or restricted build environments.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Embedding absolute local filesystem paths leaks developer environment details such as username, home directory layout, and local project location. In slide-generation or test tooling, such paths can also cause accidental local file resolution, non-reproducible builds, and unintended access to host-local assets if similar handling exists in runtime code.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The guide is entirely written to enforce Chinese-language interaction and does not provide any user language selection or opt-in path. This can cause the agent to ignore the user's preferred language, leading to consent, usability, and accessibility issues, and may cause users to misunderstand prompts or confirmations that control downstream file generation.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The code issues network requests for remote images without any user-facing notice or consent path in this workflow. In a skill advertised as converting local HTML slides, silent network access is dangerous because untrusted slide content can cause external callbacks and data exposure that users do not expect.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The renderer accepts arbitrary file:// URIs and synchronously reads local files from the host filesystem, then embeds their contents into slide output as base64. In this skill context, slide content may be influenced by user-provided HTML, so an attacker could cause unintended local file disclosure (for example, sensitive files on the machine performing conversion) without any consent prompt or path restriction.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"convert": "node convert.js"
  },
  "dependencies": {
    "playwright": "^1.61.1",
    "pptxgenjs": "^4.0.1"
  }
}

• Confidence: 92% confidence
• Finding: "playwright": "^1.61.1"

Unpinned Dependencies

Low

• Category: Supply Chain

Content

},
  "dependencies": {
    "playwright": "^1.61.1",
    "pptxgenjs": "^4.0.1"
  }
}

• Confidence: 92% confidence
• Finding: "pptxgenjs": "^4.0.1"

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/test/capture-text-test.js:40

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/test/golden.js:123

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/test/phase2-checks.js:23

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/test/phase3-checks.js:25

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/test/survey.js:118