T09 · Insecure Skill Coding Practices
Error
- Location
scripts/core/pipeline.js:63- Finding
Arbitrary Local File Read and Embedding Through Media Sources
- Content
View full analysis
- Remediation
View remediation
Security audit
Html Slides To PPTX
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a real slide-to-PPTX skill, but its converter can load remote content and local files from slide HTML without tight safety boundaries.
Install only if you trust the slide HTML and assets you will process. For third-party decks, run conversion in a sandbox or network-isolated environment, avoid absolute/file:// media paths, localize and review images, and prefer deterministic dependency installation from a trusted registry.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/core/pipeline.js:46- Finding
Server-Side Request Forgery Through Remote Image URLs
- Content
View full analysis
``` 2. The converter loads the slide ...[truncated 1220 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/core/browser.js:4- Finding
Untrusted Slide JavaScript Executes With Unrestricted Network Access
- Content
View full analysis
- Remediation
View remediation
`, inline event handlers, active frames, and other unsupported active-content elements. ]]>
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:33- Finding
First-Use Installation Executes Dependencies From a Third-Party Registry Mirror
- Content
View full analysis
" ls "$SKILL_DIR/scripts/node_modules/playwright" >/dev/null 2>&1 \ && echo OK || (cd "$SKILL_DIR/scripts" && npm install && npx playwright install chromium) ``` The lockfile resolves dependencies through a non-official registry mirror, for example: ```json "node_modules/playwright": { "version": "1.61.1", "resolved": "https://registry.npmmirror.com/playwright/-/playwright-1.61.1.tgz", "integrity": "sha512-DWnY5o3YbLWK4GovuAVwpqL+1VwGNdUGrRr++8j8PtQQzvAVZUIMjKQ90fY689sEJZJBbZVw1rXaOKSTitkzPQ==", "license": "Apache-2.0", "dependencies": { "playwright-core": "1.61.1" } } ``` The lockfile also records an optional package with an installation script: ```json "node_modules/fsevents": { "version": "2.3.2", "resolved": "https://registry.npmmirror.com/fsevents/-/fsevents-2.3.2.tgz", "integrity": "sha512-xiqMQR4xAeHTuB9yguVC1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==", "hasInstallScript": true, "license": "MIT", "optional": true } ``` ### Technical Analysis The documented first-use workflow runs `npm install`, followed by `npx playwright install chromium`. These operations download and install executable third-party components under the privileges of the invoking user. The lockfile pins artifact integrity hashes, which is a meaningful protection against accidental or opportunistic artifact replacement. However, its `resolved` URLs point to `registry.npmmirror.com` rather than the official npm registry or an organization-controlled repository. This expands the supply-chain trust boundary. A compromised mirror, malicious lockfile change, or unreviewed dependency update could cause altered packages to be installed. Using `npm install` rather than `npm ci` also permits ...[truncated 1476 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (176)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
声明描述的是一个面向用户的 HTML 幻灯片生成与 PPTX 转换技能：先访谈、落盘 brief、生成 assets/theme.css、slides/*.html、playlist.json，并调用 validate.js / convert.js。实际代码却完全没有进行访谈、内容生成、目录构建、规范校验或 PPTX 转换；它只是一个测试脚本，扫描固定测试样张文件和覆盖说明文档，验证某些正则标记是否存在，以防转换特性覆盖丢失。因此其主要目的与声明用途明显不符。这不是单纯的辅助实现细节，因为代码展现的是独立的测试/回归防护能力，而非所声明技能的核心生成流程。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是一个面向用户的 HTML 幻灯片生成/落盘/校验/转换技能，核心能力应是收集需求、生成 deck-brief、创建 slides/assets/playlist 结构，并按规范产出可转 PPTX 的内容。而实际代码并不生成任何幻灯片内容、也不进行引导式访谈、deck-brief 写入、html-spec 校验或项目目录生成。相反，它是测试基础设施：解析命令行参数，读取 fixtures 与 golden baselines，使用 Playwright 加载页面，抽取 primitives，调用 convert.js 进行转换，解包 PPTX 比对 XML，并对截图做像素/感知 diff。这属于与声明主用途 materially different 的代码，因此应判定为明显不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description is for a full HTML-to-PPTX slide creation skill. The actual code chunk does not implement any part of that workflow; it only provides deterministic normalization/stable serialization for tests. This is not merely a supporting detail clearly connected to the described end-user capability, because the snippet's primary purpose is generic test data normalization and it exposes none of the declared functionality, triggers, or resource usage.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是一个面向用户的 HTML 幻灯片生成与 PPTX 转换流程：先访谈、落盘 brief、生成 assets/slides/playlist 结构、按规范校验、再转换。而实际代码块并不生成任何幻灯片内容、也不做访谈、目录生成或 PPTX 转换。它是 scripts/test/survey.js，一个测试辅助脚本，针对 fixtures 中已有页面做静态/渲染扫描，并保存 validate 基线，用于后续兼容性或回归判断。虽然它提到了 validate.js，属于同一项目生态，但其主要用途与声明的核心功能明显不同，因此构成描述与行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个面向用户的“HTML 幻灯片生成并转换为 PPTX”的技能，核心能力应包括访谈收集需求、生成 slides/assets/playlist 结构、按 html-spec 校验并调用 convert.js 转 PPTX。提供的代码片段完全没有涉及幻灯片生成、文件落盘 deck-brief、HTML 页面构建、目录结构产出或 PPTX 转换。相反，它是 scripts/test/threshold-parity.js，一个内部测试/守卫脚本，主要目的是维护配置阈值、验证器实现和文档之间的一致性。这属于 materially different primary purpose，且展现了与声明无关的资源访问（读取 validate/.js、reference/.md、config/default.config.js）。因此描述与代码行为明显不符。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description promises an end-to-end HTML slideshow generation workflow targeting lossless PPTX conversion, including user interviewing, file tree generation (assets/theme.css, slides/*.html, playlist.json), validation, and conversion. The supplied code does none of that. Its sole purpose is to generate/update CSS color ladder variables in theme.css and preset CSS files by computing mixed colors from existing variables. This is a materially different primary purpose, even if it may belong somewhere in the broader slides project. Therefore the description does not accurately represent this code chunk.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 没有合适令牌才加进 theme.css + 16 套预设(`node scripts/tools/gen-ladder.js`),
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 没有合适令牌才加进 theme.css + 16 套预设(`node scripts/tools/gen-ladder.js`),
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/preview.js` — 视觉自查截图(Step 3.5)
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
特性组合:原生线性渐变(
nativeGradient:true)+ box-shadow + 圆角 + 富样式文字(run 级字号/颜色差异化)。html <!-- 需在 slides.config.json 设 {"nativeGradient": true} --> <!-- 渐变背景形状(原生可编辑,非截图) --> <div data-object="true" data-object-type="shape" style="position:absolute;left:0;top:0;width:1920px;height:440px;
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md </head> <body> <div class="slide-container" style="position:relative;width:1920px;height:1080px;overflow:hidden;background:var(--off-white);"> <!-- 所有可见元素都放在这里,每个都带 data-object 标记 --> </div> <template data-slide-notes> 演讲者备注(可选),会写入 PPTX 的备注区。
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md </head> <body> <div class="slide-container" style="position:relative;width:1920px;height:1080px;overflow:hidden;background:var(--off-white);"> <!-- 所有可见元素都放在这里,每个都带 data-object 标记 --> </div> <template data-slide-notes> 演讲者备注(可选),会写入 PPTX 的备注区。
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md <div data-object="true" data-object-type="shape" data-shape="triangle" style="position:absolute;left:100px;top:100px;width:120px;height:100px;background:var(--brand-dark);"></div> <!-- 右箭头(方向指示) --> <div data-object="true" data-object-type="shape" data-shape="rightArrow" style="position:absolute;left:300px;top:100px;width:200px;height:80px;background:var(--accent-orange);"></div>
Known Vulnerable Dependency: image-size==1.2.1 — 2 advisory(ies): CVE-2025-71329 (image-size: JXL and HEIF parsers allow denial of service through infinite loops); CVE-2025-71330 (image-size: ICNS parser allows denial of service through an infinite loop)
High
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
The lockfile pins image-size to 1.2.1, and the reported advisories indicate denial-of-service conditions via infinite loops in multiple image parsers. In this skill, HTML slides are converted to PPTX and image metadata handling is plausibly part of normal processing, so a crafted image embedded in slide assets could cause the conversion or validation workflow to hang or exhaust resources.
- Content
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html <!doctype html> <!-- ================================================================ P2 母版/转场/音视频夹具页(2026-07-27) 覆盖:
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html <!doctype html> <!-- ================================================================ P2 母版/转场/音视频夹具页(2026-07-27) 覆盖:
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html <body> <div class="slide-container" style="position:relative;width:1920px;height:1080px;overflow:hidden;background:#FFFFFF;font-family:'Noto Sans SC',Arial,sans-serif;"> <!-- 页头 --> <div data-object="true" data-object-type="textbox" style="position:absolute;left:100px;top:60px;width:1200px;height:50px;font-size:36px;font-weight:700;color:#0A2E5C;line-height:50px;">P2 2.1/2.2/2.6 母版·转场·音视频</div> <div data-object="true" data-object-type="shape" style="position:absolute;left:100px;top:120px;width:1720px;height:2px;background:#D5D5D0;"></div>
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html <!-- ============================================ --> <!-- 1. video 元素(poster + 占位 src) --> <!-- ============================================ --> <div data-object="true" data-object-type="textbox" style="position:absolute;left:100px;top:160px;width:800px;height:40px;font-size:24px;font-weight:600;color:#333;line-height:40px;">① video 元素</div> <!-- video:有 poster 属性(src 指向不存在的文件,仅测试提取路径) -->
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html </video> <div data-object="true" data-object-type="textbox" style="position:absolute;left:100px;top:580px;width:640px;height:30px;font-size:14px;color:#666;text-align:center;">video + poster(封面截图)</div> <!-- video:无 poster(将截取浏览器渲染帧) --> <video data-object="true" src="demo.mp4" style="position:absolute;left:820px;top:210px;width:640px;height:360px;background:#1A1A2E;border-radius:8px;z-index:1;"> </video>
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill declares executable capabilities via Node/npm and instructs the agent to run local commands that can access environment state and install dependencies, but it does not define an explicit tool scope such as allowed tools or permissions. That creates unnecessary ambiguity about what the skill may read, modify, or fetch, increasing the chance of overbroad execution in an agent runtime.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest description and the rest of the file instruct the workflow entirely in Chinese, including the required guided interview behavior, but do not state that the user may choose another language. This creates a natural-language policy concern because the skill appears to impose a specific language/locale without documented user opt-in or justification.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
The command uses
npx playwrightwithout pinning an exact version, which can fetch and execute whatever package version is currently resolved at runtime. This introduces supply-chain and reproducibility risk, especially because the command may run during first use and install browser binaries.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The entire template, including headings and operational instructions, is written in Chinese and provides no indication that users may choose another language or locale. Under the policy criteria, forcing a specific language without opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown template is written entirely in Chinese and structures the skill output in Chinese terms throughout, with no indication that the user can choose another language. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This markdown file is written entirely in Chinese and provides usage instructions only in that language, with no indication that users may choose another language or that the skill is intentionally region-specific. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation.
- Content