Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
- Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Security audit
汇报PPT助手
Security checks for vulnerabilities and agentic risk
Overview
The skill is on-purpose for making PPT files, but included instructions conflict over whether the user must confirm before files are created.
Review this skill before installing if you want strict control over file creation. Use it only with a clear instruction such as 'outline only' until you are ready, and confirm the output path and filename before allowing .pptx generation or any pip install.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)
Intent-Code Divergence
High
- Confidence
- 98% confidence
- Finding
- The template explicitly instructs the agent to generate a .pptx immediately after producing the text plan, which conflicts with the skill’s documented requirement to wait for user confirmation first. In an agent setting, this can cause unauthorized side effects, wasted compute, and user-surprising file creation because template instructions may override safer workflow expectations.
Missing User Warnings
Medium
- Confidence
- 93% confidence
- Finding
- The README states that the skill will generate a `.pptx` file by default in the same round, which implies writing a file to the user's system without an explicit opt-in confirmation at the point of action. Even though creating a presentation file is aligned with the skill's purpose, silent default file creation can surprise users, overwrite expected workflows, or normalize agent-initiated filesystem writes without clear consent.
Natural-Language Policy Violations
Medium
- Confidence
- 85% confidence
- Finding
- The skill name and all user-facing instructions are written entirely in Chinese, which implies a fixed language/locale expectation for interaction. There is no statement that users may choose another language or that the skill is intentionally limited to a Chinese-speaking environment for a documented regional reason.
Natural-Language Policy Violations
Medium
- Confidence
- 89% confidence
- Finding
- The document labels Chinese fonts as mandatory and the overall instructions are written as a default workflow for PPT generation, which can force a specific language/locale presentation style. Under SQP-3, locale or language constraints should not be imposed without opt-in unless clearly justified as region-specific.
Missing User Warnings
Medium
- Confidence
- 94% confidence
- Finding
- The skill instructs code to write `.pptx` files directly to the user's Desktop or Documents, which is a local filesystem side effect. In an agent context, creating files without an explicit user opt-in or a clear warning can violate user expectations, clutter trusted locations, and normalize silent host writes by generated code.
Natural-Language Policy Violations
Medium
- Confidence
- 78% confidence
- Finding
- The template is entirely written as a Chinese-language presentation outline and does not indicate that language should be chosen based on user preference. Under the policy, forcing a specific language without opt-in can be a locale/language policy violation unless the constraint is explicitly documented and justified.
Missing User Warnings
Medium
- Confidence
- 95% confidence
- Finding
- The template directs immediate PPTX generation without requiring explicit user approval, warning, or a final review step. Even if the action is not inherently destructive, it is still an unauthorized file-generation side effect that can bypass user intent and reduce operational safety in agent workflows.
Static analysis
No suspicious patterns detected.