深知可信PPT

• Outcome: Review
• Latest audit: Sep 2, 2026 · 7:04 AM UTC
• Version: 1.1.0

Overview

The skill is mostly a PPT generator, but it also performs phone-based account/API-key setup while telling the agent to hide those details from users.

Review this before installing if your presentations or search topics are sensitive. The skill may ask for a phone number and verification code to set up access to an external search service, handle an API key, send search queries to dknowc, and copy generated files to a workspace. Do not proceed unless users are clearly told about the account/key setup and where outputs are delivered.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tainted flow: 'target' from os.environ.get (line 161, credential/environment) → shutil.copy2 (file write)

Medium

• Category: Data Flow

Content

continue
            target = dest / src.name
            try:
                shutil.copy2(src, target)
                results.append({
                    "copied": True,
                    "source": str(src),

• Confidence: 89% confidence
• Finding: The destination directory is derived from untrusted sources such as environment variables or a user-supplied --dest, then used in shutil.copy2 without constraining where files may be written. In an agent or host environment, a malicious or misconfigured workspace variable could redirect copied outputs to an unintended path, causing data leakage, overwriting files the agent can access, or delivery into an attacker-controlled directory.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This script materially expands the skill’s capability from PPT generation into user account registration and API key issuance against external services. In a skill whose declared purpose is document generation, hidden credential-provisioning logic is dangerous because it can obtain, return, and encourage handling of sensitive API credentials outside the user’s normal onboarding and governance flow.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The register path not only creates accounts but can also mint a fresh API key using an existing bearer token, then returns the live key in stdout. That is a sensitive credential-management workflow embedded in an unrelated skill, increasing the risk of unauthorized key creation, accidental disclosure in logs, and bypass of centralized access control or approval processes.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The code broadens file readability after export by applying permissive mode bits and, on Windows, granting the built-in Users group read access. In a multi-user environment, this can expose generated presentations to unintended local users, especially if exports may contain sensitive business or policy content typical for this skill.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: The README instructs users to obtain and use an external API key for trusted search, but it does not mention safe credential handling, storage, or that user-provided materials and queries may be transmitted to a third-party service. In a skill that processes PPT source material, this omission can cause users to expose sensitive internal documents, prompts, or keys without understanding the privacy boundary.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The spec hard-requires Chinese speaker notes for every slide without indicating that the language should follow the user's preference or be configurable. This can cause the agent to ignore user language intent, produce inaccessible output for non-Chinese users, and create privacy/compliance issues in multilingual environments where forced localization is inappropriate.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script transmits the user's query, and potentially sensitive optional context such as service area and effective time, to a remote third-party endpoint. While this appears necessary for the skill's functionality and uses HTTPS, there is no explicit consent, warning, or minimization control in the code path, so users may unknowingly disclose sensitive information externally.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.