Markdown To Ppt

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:22 AM UTC
• Version: 1.1.0

Overview

This is a coherent local Markdown-to-slides converter, with a limited caution that its HTML fallback does not escape Markdown content safely.

Install only if you are comfortable running a local converter script. Avoid converting untrusted Markdown when python-pptx is unavailable, or inspect the generated HTML before opening it in a browser, because embedded HTML from the source Markdown may remain active.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/md2ppt.py:68

Finding

Unescaped Markdown Content Enables HTML Injection in Fallback Output

Content

View full analysis

Vulnerability Details

File Location: scripts/md2ppt.py, lines 68–74
Vulnerability Type: HTML injection and potential script execution
Risk Level: Medium

Vulnerable Code

python

html += f'<div class="slide"><h1>{title}</h1>\n'
for b in bullets:
    html += f'<li>{b}</li>\n'
if code:
    html += f'<pre><code>{code}</code></pre>\n'
html += '</div>\n'

Technical Analysis

The HTML fallback directly interpolates Markdown-derived title, bullets, and code values into an HTML document without context-appropriate escaping or sanitization. Consequently, HTML metacharacters and active elements supplied through the input Markdown retain their browser semantics.

The vulnerable path is reached when the optional python-pptx module is unavailable. In that environment, create_pptx() generates an HTML presentation instead of a PPTX file. A malicious input value such as an image element with an event handler can therefore become executable browser content rather than presentation text.

The issue is classified as an insecure coding practice because untrusted document content crosses into an active HTML context without output encoding.

Attack Path

1. An attacker prepares a Markdown document containing malicious HTML in a heading, bullet, or fenced code block.
2. The attacker persuades a victim to convert that document using this Skill.
3. The victim's environment does not have python-pptx installed, causing the converter to select its HTML fallback.
4. The malicious value is inserted verbatim into the generated HTML file.
5. The victim opens the generated presentation in a browser.
6. The browser interprets the injected markup and may execute event handlers or scripts permitted by its security policy.

Impact Assessment

Exploitation can execute attacker-controlled browser-side content in the context of the generated local presentation. This can alter or spoof presentation cont ...[truncated 466 chars]

Remediation

View remediation

Remediation Suggestions

Escape every untrusted value before inserting it into HTML:

python

import html

safe_title = html.escape(title, quote=True)
html_output += f'<div class="slide"><h1>{safe_title}</h1>\n'

for bullet in bullets:
    safe_bullet = html.escape(bullet, quote=True)
    html_output += f'<li>{safe_bullet}</li>\n'

if code:
    safe_code = html.escape(code, quote=True)
    html_output += f'<pre><code>{safe_code}</code></pre>\n'

Apply the following additional controls:

• Prefer a template engine configured with automatic HTML escaping.
• Treat headings, bullets, and code blocks as plain text unless raw HTML is an explicitly supported and sanitized feature.
• If limited HTML formatting must be supported, sanitize it with a maintained allowlist-based HTML sanitizer rather than relying on string replacement.
• Add a restrictive Content Security Policy to the generated document as defense in depth, while retaining output encoding as the primary fix.
• Add regression tests for injection through headings, list items, and fenced code blocks, including event handlers, malformed tags, quotes, ampersands, and closing-tag payloads.
• Ensure tests cover the environment where python-pptx is unavailable so the fallback path receives routine security coverage.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The body text presents the skill description only in Chinese at L09, while the policy requires avoiding forced language or locale choices unless the user is given an option or the restriction is justified. Although some bilingual text appears elsewhere, this line still indicates a default language constraint without an explicit opt-in or documented locale-specific purpose.

Content

No source excerpt is available for this finding.