Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
汇报PPT助手
Security checks for vulnerabilities and agentic risk
Overview
The skill is on-purpose for making PPT files, but included instructions conflict over whether the user must confirm before files are created.
Review this skill before installing if you want strict control over file creation. Use it only with a clear instruction such as 'outline only' until you are ready, and confirm the output path and filename before allowing .pptx generation or any pip install.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The template explicitly instructs the agent to generate a .pptx immediately after producing the text plan, which conflicts with the skill’s documented requirement to wait for user confirmation first. In an agent setting, this can cause unauthorized side effects, wasted compute, and user-surprising file creation because template instructions may override safer workflow expectations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README states that the skill will generate a
.pptxfile by default in the same round, which implies writing a file to the user's system without an explicit opt-in confirmation at the point of action. Even though creating a presentation file is aligned with the skill's purpose, silent default file creation can surprise users, overwrite expected workflows, or normalize agent-initiated filesystem writes without clear consent.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The skill name and all user-facing instructions are written entirely in Chinese, which implies a fixed language/locale expectation for interaction. There is no statement that users may choose another language or that the skill is intentionally limited to a Chinese-speaking environment for a documented regional reason.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The document labels Chinese fonts as mandatory and the overall instructions are written as a default workflow for PPT generation, which can force a specific language/locale presentation style. Under SQP-3, locale or language constraints should not be imposed without opt-in unless clearly justified as region-specific.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs code to write
.pptxfiles directly to the user's Desktop or Documents, which is a local filesystem side effect. In an agent context, creating files without an explicit user opt-in or a clear warning can violate user expectations, clutter trusted locations, and normalize silent host writes by generated code.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The template is entirely written as a Chinese-language presentation outline and does not indicate that language should be chosen based on user preference. Under the policy, forcing a specific language without opt-in can be a locale/language policy violation unless the constraint is explicitly documented and justified.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The template directs immediate PPTX generation without requiring explicit user approval, warning, or a final review step. Even if the action is not inherently destructive, it is still an unauthorized file-generation side effect that can bypass user intent and reduce operational safety in agent workflows.
- Content