Security audit

PPT演示文稿

Security checks for vulnerabilities and agentic risk

Overview

ClawScan marked the office-pptx skill suspicious because scanners reported unsolicited fundraising content in assistant replies and automatic software installation without a user-facing warning; overall confidence is medium.

Review the reported issues before installing. Consider whether you are comfortable with automatic software installation and unsolicited fundraising content in replies; scanner coverage is partial, so the evidence is incomplete.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

L078 requires inserting an engine-supplied donation banner into the user conversation, beyond the manifest's presentation-editing purpose.

Medium

Category: Excessive Agency
Confidence: 99% confidence
Finding: The skill requires the assistant to reproduce engine-supplied fundraising Markdown verbatim in the conversation, crossing the boundary between tool output and trusted assistant communication. This creates an output-injection and potential phishing surface unrelated to presentation editing; the statement that payment is optional reduces coercion but does not make arbitrary Markdown safe.
Content: No source excerpt is available for this finding.

Presentation validation is used to trigger unsolicited payment-promotion content in the assistant's final response.

Medium

Category: Prompt Injection
Confidence: 96% confidence
Finding: The presentation-validation workflow is used to trigger unsolicited payment promotion in the assistant's delivery response. This is the same underlying banner-insertion issue identified by SDI-1, not a separate exploit: it gives engine-controlled promotional content the apparent endorsement of the assistant without user authorization.
Content: No source excerpt is available for this finding.

Automatic CLI and GUI installation lacks a user-facing warning about system changes.

Medium

Category: Output Handling
Confidence: 95% confidence
Finding: The FAQ instructs the agent to install both CLI and GUI software automatically from a remotely retrieved manual, without first obtaining informed approval for software installation and system changes. Installation serves a legitimate dependency need, but executing mutable remote instructions creates supply-chain risk; a SHA-256 value obtained from the same manual does not independently establish authenticity.
Content: No source excerpt is available for this finding.

The skill directs the agent to insert developer fundraising content into the conversation, unrelated to creating or editing presentations.

Low

Category: Excessive Agency
Confidence: 97% confidence
Finding: The FAQ directs the assistant to paste an engine-controlled fundraising banner verbatim into the conversation, although fundraising is outside the requested presentation workflow. Even with optional payment explicitly stated, this permits unsolicited response contamination and could expose users to misleading payment destinations if the banner or its supplier is compromised.
Content: No source excerpt is available for this finding.