Ppt Deck Master

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:57 AM UTC
• Version: 1.5.0

Overview

The skill is mostly a coherent PPT image-generation workflow, but its API-key handling can send a credential to the wrong external provider.

Review before installing or running. Use a dedicated low-privilege API key, set only one provider credential at a time, avoid sensitive or confidential presentation content unless the chosen provider is approved, and install dependencies in a virtual environment with pinned versions where possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate_deck.py:34

Finding

Credential May Be Disclosed to the Wrong API Provider

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: SKILL.md:174

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Remediation

View remediation

--hash=sha256: ``` 4. Install dependencies in a dedicated virtual environment rather than the system Python environment. 5. Use `pip install --require-hashes -r requirements.txt`. 6. Periodically review pinned versions for security updates and update them through a controlled process. 7. Avoid recommending administrative or root-level package installation. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence

Finding

The code is clearly related to AI PPT generation, so the description is directionally aligned at a high level. However, the declared purpose significantly overstates the implemented functionality. The script does not accept a one-sentence requirement and turn it into a full presentation; instead, it requires an already prepared slides.json with per-slide prompts. It also does not perform content planning, copywriting, QA iteration, or full delivery workflow beyond optional PPTX assembly. Its actual role is narrower: image generation for slides plus PPT assembly. Additionally, while it supports Ofox and OpenRouter as declared, the code invokes a Gemini image model endpoint rather than demonstrating a distinct 'Nano Banana Pro' integration. Therefore, the description does not accurately represent the full behavior and capabilities of the supplied code.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

md

python3 scripts/generate_deck.py

    # 3. 只重跑某一页
    rm scripts/output/slide_03.jpg && python3 scripts/generate_deck.py --start 3 --end 3

    # 4. 生成完自动组装 PPTX
    python3 scripts/generate_deck.py --assemble

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill hard-codes that names must be Chinese and explicitly forbids English names, overriding user-provided or source-accurate identities. This can cause content corruption, misrepresentation of people or brands, and failure for multilingual or non-Chinese presentations; while not a classic exploit, it is a genuine unsafe prompt constraint that can force incorrect output.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/generate_deck.py (reported line 16)May include surrounding context.

python

python3 generate_deck.py --start 1 --end 5

    # 重跑某一页（先删旧图）
    rm output/slide_03.jpg && python3 generate_deck.py --start 3 --end 3
"""

import json

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 81% confidence

Finding

The skill instructs use of environment variables, file reads/writes, and outbound API access, but it declares no explicit tool scope or permission boundaries. In an agent environment, this can cause overbroad authority to be granted implicitly, increasing the blast radius if prompts, file paths, or API targets are later influenced by untrusted input.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The natural-language description and title present the skill as a Chinese PPT creation workflow, and the instructions later emphasize Chinese rendering and Chinese-specific prompt handling. There is no explicit opt-in, alternative language option, or justification that this skill is intended only for a Chinese-language region or compliance context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instruction states that all Chinese text must be clearly readable, which constrains the skill's output to Chinese. This is reinforced later by a mandatory Chinese-name requirement, indicating a fixed language policy rather than an optional locale choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code file contains natural-language instructions and descriptions only in Chinese, including the module docstring that explains usage. Because the skill does not provide an opt-in language choice or justify a Chinese-only locale restriction, it can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The script transmits slide prompts and an API bearer token to a third-party external service. In this skill context, prompts may contain proprietary business content or sensitive presentation material, so sending them off-host creates confidentiality risk if users are unaware, and trust is placed in the remote provider's handling of data.

Content

Scanner excerpt · scripts/generate_deck.py (reported line 52)May include surrounding context.

python

"response_format": "b64_json"
    }).encode("utf-8")
    req = urllib.request.Request(
        "https://api.ofox.ai/v1/images/generations",
        data=payload,
        headers={"Content-Type": "application/json", "Authorization": f"Bearer {api_key}"}
    )

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The JSON template hard-codes the system/style prompt in Chinese and explicitly requires Chinese text to be clearly readable, which steers generated output toward Chinese regardless of the user's language preference. This can override or conflict with user intent, reduce usability for non-Chinese users, and create prompt-control behavior that is inappropriate in a general-purpose skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The document is entirely written in Chinese and presents mandatory writing rules without offering any language choice or stating that the skill is intentionally limited to Chinese-language content. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script's documented runtime guidance contradicts its actual credential-loading behavior. detect_provider() only checks OFOX_API_KEY and OPENROUTER_API_KEY, so the printed instruction to export IMAGE_API_KEY is inaccurate and can mislead users about how the skill works.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The natural-language instructions specify that all Chinese text must use Chinese sans-serif fonts and the prompts throughout the file are written to require exact Chinese rendering. This imposes a specific language/locale expectation without any opt-in or alternative for users who may need another language.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.