Image To PPT Pro

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:55 AM UTC
• Version: 1.0.1

Overview

The skill appears aimed at converting images into editable PowerPoint files, but normal use can automatically modify the host environment by installing unpinned system and Python packages.

Install or run this only in an isolated, disposable environment with dependencies pre-provisioned and pinned. Do not allow the skill to run apt-get, global npm installs, or pip --break-system-packages on a shared host without explicit approval. Treat generated output and preview cleanup paths as writable workspace data, not general home-directory cleanup.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/extract_text.py:15

Finding

Automatic Installation of Unpinned System and Python Dependencies

Content

View full analysis

Vulnerability Details

File Location: scripts/extract_text.py, lines 15–24
Vulnerability Type: Automatic installation of unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

python

def ensure_deps():
    try:
        import pytesseract
        pytesseract.get_tesseract_version()
        return pytesseract
    except Exception:
        print("Installing tesseract-ocr...")
        subprocess.run(["apt-get","install","-y","-q",
                        "tesseract-ocr","tesseract-ocr-chi-sim"], check=True)
        subprocess.run([sys.executable,"-m","pip","install","pytesseract",
                        "--break-system-packages","-q"], check=True)
        import pytesseract
        return pytesseract

The same unsafe installation approach is also documented in SKILL.md, lines 25–26 and 484–498:

bash

npm install -g pptxgenjs
pip install Pillow numpy pytesseract --break-system-packages -q

python

subprocess.run(["apt-get","install","-y","-q",
                "tesseract-ocr","tesseract-ocr-chi-sim"], check=True)
subprocess.run([sys.executable,"-m","pip","install","pytesseract",
                "--break-system-packages","-q"], check=True)

Technical Analysis

The OCR helper automatically invokes APT and pip when any exception occurs while importing pytesseract or querying the Tesseract version. The installed packages are not pinned to exact versions, verified with hashes, or resolved through a lockfile. Consequently, the effective code installed at runtime may change independently of the audited project.

The --break-system-packages option bypasses Python environment protections and permits modification of the host-managed Python environment. Likewise, the documented global npm installation modifies a shared package location.

The broad except Exception clause further expands the trigger condition. An unrelated runtime or configuration error—not merely a missing dependency—can initiate package-manag ...[truncated 1682 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove automatic package installation from ensure_deps() and fail safely with a clear dependency error.
2. Provision dependencies before runtime in an isolated virtual environment or container.
3. Pin exact APT, pip, and npm dependency versions through reproducible build configuration.
4. Use a hash-locked requirements file, such as pip install --require-hashes -r requirements.txt.
5. Add and enforce an npm lockfile; avoid global npm installation.
6. Do not use --break-system-packages. Install Python dependencies into a dedicated virtual environment.
7. Catch only expected errors such as ImportError or ModuleNotFoundError; report Tesseract configuration failures separately instead of initiating installation.
8. Use trusted, explicitly configured repositories and verify package provenance where supported.
9. Build dependencies with minimal privileges, then run OCR as an unprivileged user in a restricted environment.
10. Update SKILL.md so its installation instructions follow the same pinned and isolated dependency process.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (13)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The OCR helper includes logic to install system packages with apt-get at runtime, granting the skill an unnecessary privilege-escalating capability for a document conversion workflow. This is dangerous because it expands the blast radius from simple file processing to host-level package modification, enabling unintended system changes or abuse if the script is triggered in a privileged environment.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 92% confidence

Finding

The skill performs a shell deletion command using a wildcard (rm -f /home/claude/slide-*.jpg) as part of its workflow. Even though the path appears constrained, destructive file operations are unnecessary for the core transformation task and can delete unintended files if naming collisions, symlinks, or environment assumptions change.

Content

Scanner excerpt · SKILL.md (reported line 988)May include surrounding context.

python /mnt/skills/public/pptx/scripts/office/soffice.py
--headless --convert-to pdf /mnt/user-data/outputs/output.pptx

rm -f /home/claude/slide-.jpg pdftoppm -jpeg -r 150 /home/claude/output.pdf /home/claude/slide ls -1 /home/claude/slide.jpg

text

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger instructions are overly broad, explicitly telling the agent to activate even when users merely upload images and request .pptx output, not just exact-replication cases. This is dangerous because it can cause the skill to run in situations outside its intended scope, increasing the chance of unnecessary tool use, unsafe file handling, or execution of its higher-risk workflow on benign requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

L0501 hard-codes OCR to use lang="chi_sim+eng", and the document repeatedly prescribes Chinese-specific vertical text handling and Chinese fonts as defaults. This imposes a locale/language choice in the workflow rather than offering it based on the user's content or preference.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The docstring understates what the script does by documenting dependency installation incompletely while the code also performs apt-get system package installation. This mismatch can mislead reviewers and operators, reducing informed consent and making the hidden environment-changing behavior more dangerous in practice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script performs automatic package installation and system modification without prompting the user, which is especially unsafe for an OCR utility whose expected function is only text extraction. In agent or automation environments, this creates unexpected privilege use, persistent host changes, and a path for dependency-based compromise or operational disruption.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 92% confidence

Finding

The script automatically invokes apt-get to install system packages when imports fail, causing host-level modification without explicit user consent. In an agent skill context, this is risky because simply running OCR on an image can unexpectedly alter the environment, require elevated privileges, and expand the attack surface through package installation side effects.

Content

Scanner excerpt · scripts/extract_text.py (reported line 20)May include surrounding context.

python

return pytesseract
    except Exception:
        print("Installing tesseract-ocr...")
        subprocess.run(["apt-get","install","-y","-q",
                        "tesseract-ocr","tesseract-ocr-chi-sim"], check=True)
        subprocess.run([sys.executable,"-m","pip","install","pytesseract",
                        "--break-system-packages","-q"], check=True)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 95% confidence

Finding

The script automatically runs pip install with --break-system-packages, which can modify the Python environment in unsafe ways and bypass protections intended to prevent system package conflicts. In a shared or managed environment, this can destabilize the host, introduce unreviewed code from package repositories, and create supply-chain exposure during normal skill execution.

Content

Scanner excerpt · scripts/extract_text.py (reported line 22)May include surrounding context.

python

print("Installing tesseract-ocr...")
        subprocess.run(["apt-get","install","-y","-q",
                        "tesseract-ocr","tesseract-ocr-chi-sim"], check=True)
        subprocess.run([sys.executable,"-m","pip","install","pytesseract",
                        "--break-system-packages","-q"], check=True)
        import pytesseract
        return pytesseract

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This markdown file includes sample code that writes output.pptx to disk via pres.writeFile(...), which is a file-creating operation. The surrounding documentation presents it as a basic example but does not mention that running it will create or potentially overwrite a local file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The comment Font (required for Chinese) and later guidance that Chinese must specify particular fonts impose a language-specific requirement in natural language. As written, this can be read as forcing a specific locale/font behavior rather than presenting it as an optional compatibility note or scoped recommendation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The statement Chinese must specify font is a blanket natural-language rule tied to a specific language. It does not offer user choice or clearly limit the guidance to a particular rendering environment, which makes it read like an unnecessary locale-specific policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Line L139 hard-codes fontFace: "Microsoft YaHei", which implies a specific language/locale preference in the example guidance. Because this is natural-language-facing reference material and it does not offer an opt-in or alternative font choice, it can conflict with language/locale neutrality expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The script repeatedly specifies "Microsoft YaHei", a font associated with Simplified Chinese text rendering, in user-facing slide content. Under the policy rule, forcing a specific language/locale-related presentation choice without user opt-in can be a natural-language policy concern, especially since the template comments and labels are otherwise generic rather than region-specific.

Content

No source excerpt is available for this finding.