Html Slides To PPTX

• Outcome: Review
• Latest audit: Aug 18, 2026 · 1:43 AM UTC
• Version: 2.1.0

Overview

This slide-conversion skill is mostly coherent, but it can silently fetch remote images and embed local files referenced by slide HTML into generated PPTX files.

Install only if you trust the slide HTML and assets being converted. Avoid converting untrusted HTML, review slides for remote image URLs and file:// or absolute local paths before running conversion, and clear or disable slides/.cache when working with sensitive material.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill instructs the agent to run shell commands that may install packages with npm and download browser binaries via Playwright, yet the metadata only declares required binaries and does not declare corresponding network/environment-sensitive capabilities. This creates a transparency and policy-enforcement gap: an operator may believe the skill is low-privilege while it can trigger dependency installation and external downloads, increasing supply-chain and unintended network-exposure risk.

Context-Inappropriate Capability

Low

• Confidence: 93% confidence
• Finding: The fixture HTML imports Google Fonts over the network, which creates an unnecessary external dependency for a local test fixture and can leak metadata such as IP address, environment access patterns, or build activity to a third party. In CI, offline, or restricted environments, this also undermines reproducibility and can cause unexpected failures or policy violations.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The template explicitly says this file does not require user confirmation, even though it determines page-level content that can materially shape the final deck. In a slide-generation skill, suppressing confirmation at this stage increases the risk that fabricated, misinterpreted, or overconfident claims are propagated into output without the user noticing until late in the workflow.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: The template is entirely in Chinese and does not offer a language choice, which can cause operators or users to misunderstand control points, sourcing rules, and risk safeguards. In this skill, misunderstanding the template can lead to skipped validation, incorrect source classification, or accidental inclusion of unsupported claims in generated slides.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The code automatically fetches any http(s) image referenced by extracted slide content and converts it to an inlined data URI. This creates an SSRF-like outbound request surface and a privacy leak: opening untrusted HTML slides can trigger network access to attacker-controlled URLs, exposing the host IP/environment and potentially contacting internal services if the process can reach them. In this skill context, users expect local HTML-to-PPTX conversion, so silent network access is more dangerous because it is surprising and may occur during routine document processing.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The renderer accepts arbitrary file:// URIs and reads the referenced local file directly from the host filesystem, then embeds its contents into slide output. In the context of an agent skill that generates user-influenced HTML slides and converts them to PPTX, this can expose sensitive local files if an attacker can cause src to reference paths such as configuration files, credentials, or other host data.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"convert": "node convert.js"
  },
  "dependencies": {
    "playwright": "^1.61.1",
    "pptxgenjs": "^4.0.1"
  }
}

• Confidence: 90% confidence
• Finding: The dependency uses a caret range, which allows npm to install newer compatible versions automatically. This creates a supply-chain integrity risk because a compromised or breaking upstream release could be pulled into validation or conversion workflows without an explicit review, especially since Playwright executes browser automation code during slide rendering/conversion.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

},
  "dependencies": {
    "playwright": "^1.61.1",
    "pptxgenjs": "^4.0.1"
  }
}

• Confidence: 86% confidence
• Finding: Using a floating semver range for pptxgenjs means future package releases can be consumed implicitly, increasing exposure to supply-chain attacks or unexpected behavior changes in document generation. In this skill, the package participates directly in PPTX creation, so a malicious upstream update could affect produced files or execution during conversion.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/test/capture-text-test.js:40

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/test/generation-checks.js:223

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/test/golden.js:129

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/test/phase2-checks.js:23

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/test/phase3-checks.js:25

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/test/survey.js:118