PPT 生成 AI PPT Slides

• Outcome: Review
• Latest audit: Oct 28, 2026 · 2:59 AM UTC
• Version: 1.0.26

Overview

The presentation workflow fits its purpose, but its connection checks can expose your API key through insecure addresses or redirects.

Before supplying your API key, have authenticated connections restricted to HTTPS and redirects protected against destination changes or downgrades. Generation sends slide prompts and selected images to dLazy and consumes credits. Use only material approved for that service, and expect a persistent shared runtime and key configuration in ~/.dlazy-ppt.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (35)

Tainted flow: 'req' from os.getenv (line 197, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

Sending the dLazy key to its API is expected, but the request does not require HTTPS or constrain redirects. urllib's default redirect handling can retain the explicit Authorization header across origins, allowing a malicious or compromised endpoint to redirect the request to a credential collector; an HTTP base URL also exposes the key in transit.

Content

Scanner excerpt · scripts/dlazy_ppt_runtime.py (reported line 206)May include surrounding context.

python

method="GET",
    )
    try:
        with urllib.request.urlopen(req, timeout=timeout) as resp:
            print(f"tool manifest: HTTP {resp.status}")
            return json.loads(resp.read().decode("utf-8", "replace"))
    except urllib.error.HTTPError as exc:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/image-model-configuration.md (reported line 64)May include surrounding context.

The config is written to:

text

~/.dlazy-ppt/.env

The file is created with mode 0600. It is shared by Codex, Claude Code, OpenClaw, Hermes Agent, and other local agents, so the key is configured once per machine.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/dlazy_ppt_runtime.py (reported line 49)May include surrounding context.

python

def _env_path(home: Path) -> Path:
    return home / ".env"


def _requirements_path() -> Path:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/dlazy_ppt_runtime.py (reported line 274)May include surrounding context.

python

bootstrap.add_argument("--upgrade", action="store_true")
    bootstrap.set_defaults(func=_bootstrap)

    config = subparsers.add_parser("config", help="Write or update the shared .env")
    config.add_argument("--api-key", help=f"dLazy API key from {API_KEY_URL}")
    config.add_argument("--base-url", help="Override the dLazy base URL (self-hosted deployments)")
    config.add_argument("--clear-base-url", action="store_true")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/image_gen.py (reported line 80)May include surrounding context.

python

def _runtime_env_path() -> Path:
    return _runtime_home() / ".env"


def _load_runtime_env() -> None:

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/image_gen.py (reported line 158)May include surrounding context.

python

_die(f"Prompt file not found: {path}")
        return path.read_text(encoding="utf-8").strip()
    if prompt:
        return prompt.strip()
    _die("Missing prompt. Use --prompt or --prompt-file.")
    return ""  # unreachable

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/image_gen.py (reported line 343)May include surrounding context.

python

def _augment_prompt_fields(augment: bool, prompt: str, fields: Dict[str, Optional[str]]) -> str:
    if not augment:
        return prompt

    sections: List[str] = []
    if fields.get("use_case"):

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, network, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The workflow requires third-party image generation without explicitly disclosing that source-derived slide content will be sent to dLazy.

Medium

• Category: Output Handling
• Confidence: 89% confidence

Finding

The workflow requires external image generation from source-derived slide content and may include user-supplied assets, but it does not explicitly explain that those materials will leave the local environment or require acknowledgment of that disclosure. Naming dLazy and requiring an API key make the service dependency visible, reducing concern about covert exfiltration, but users could still submit confidential material without understanding the data transfer.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

md

4. Check that the dLazy runtime is ready.
   - Before generating any slide image, read `docs/image-generation-cli.md`.
   - Run `scripts/dlazy_ppt_runtime.py doctor --check-api` once per environment. Read `docs/image-model-configuration.md` only if it reports missing or invalid configuration.
   - This is a readiness check, not a choice. Do not ask the user to pick a backend, and do not pause for confirmation unless the check fails.

5. Generate one sample slide for approval.
   - Before generating or approving the sample slide, read `docs/outline-style-and-sample.md`.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · docs/image-generation-cli.md (reported line 15)May include surrounding context.

python3 {skill_root}/scripts/dlazy_ppt_runtime.py bootstrap

text

This is an internal setup step for the skill. Do not ask the user to run it unless dependency installation fails and user approval or troubleshooting is required.

The CLI loads `~/.dlazy-ppt/.env` automatically for `DLAZY_API_KEY`, `DLAZY_BASE_URL`, and `DLAZY_PPT_IMAGE_MODEL`. Do not manually parse `.env`. For API key, base URL, model, and config troubleshooting, read `image-model-configuration.md` only after the CLI reports missing or invalid configuration, when the user explicitly wants to change those settings, or when a real API call reports an authentication, permission, credit, or model availability failure.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · docs/project-assembly-and-reporting.md (reported line 107)May include surrounding context.

python3 {skill_root}/scripts/dlazy_ppt_runtime.py bootstrap

text

This is an internal setup step for the skill. Do not ask the user to run these commands unless dependency installation fails and user approval or troubleshooting is required.

Run:

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · docs/outline-style-and-sample.md (reported line 20)May include surrounding context.

md

Save the draft to `{base_dir}/{deck_name}/outline.md` once the project directory is known. If the output directory is not known yet, show the outline in chat first and write it to `outline.md` immediately after creating the project directory.

Show the outline to the user for confirmation and wait for approval before moving to visual style selection or image generation, unless the user explicitly asked you to skip confirmation. If any slide lists required source images, explicitly ask the user to verify that each image is assigned to the correct slide and role before generation. If the user requests changes, update `outline.md` and ask for confirmation again.

Stop after writing the outline draft. At this point, report the `outline.md` path, slide count, required source images and their slide mapping, and that no slide images or PPTX have been generated yet. Do not proceed to `deck_spec.json`, `speech.md`, prompt preparation, style selection, or sample generation until the user approv

The sample approval workflow assumes Chinese-language slide text without user opt-in.

Medium

• Category: Output Handling
• Confidence: 86% confidence

Finding

The workflow unconditionally asks the user to confirm Chinese text quality, making a language-specific criterion part of every sample approval. No preceding instruction establishes that the user selected Chinese or justifies restricting the slide language.

Content

No source excerpt is available for this finding.

The slide-editing workflow lacks a warning that slide content is sent to an image-generation API.

Medium

• Category: Output Handling
• Confidence: 90% confidence

Finding

The editing workflow passes an existing slide image to an image-generation service without explaining that its contents leave the local environment or requiring a sensitivity check. Slides derived from internal reports or research could therefore expose confidential information to the configured API provider. Using dLazy is part of the skill's stated purpose, which reduces surprise, but does not establish informed authorization to upload sensitive source-derived images.

Content

No source excerpt is available for this finding.

The reusable slide-job template hardcodes Chinese without requiring the user's language choice.

Medium

• Category: Output Handling
• Confidence: 93% confidence

Finding

The general-purpose template sets "language" to "Chinese" and instructs the image tool to render Chinese text, rather than deriving the language from the user's request. Although L219 conditionally discusses Chinese decks, the template itself is not restricted to those decks and provides no language opt-in.

Content

No source excerpt is available for this finding.

The naming rules direct the agent to prefer Chinese style names without user language opt-in.

Medium

• Category: Output Handling
• Confidence: 96% confidence

Finding

The instruction prescribes Chinese for generated style names regardless of the user's language preference. No user language choice or locale-specific justification is provided.

Content

No source excerpt is available for this finding.

The typography brief prescribes Chinese slide-title text without offering a language choice.

Medium

• Category: Output Handling
• Confidence: 86% confidence

Finding

The title specification explicitly calls for Chinese handwriting, reinforced by a Chinese-specific text-quality requirement. This general-purpose visual style provides neither user opt-in nor a locale-specific justification for constraining generated text to Chinese.

Content

No source excerpt is available for this finding.

The style brief requires Chinese slide text without user language opt-in.

Medium

• Category: Output Handling
• Confidence: 97% confidence

Finding

The typography instructions specify Chinese body text and require Chinese text to be accurate and legible. This imposes a particular output language without offering a choice or documenting why the handmade visual style requires that language.

Content

No source excerpt is available for this finding.

The typography brief requires Chinese slide text without offering a language choice.

Medium

• Category: Output Handling
• Confidence: 90% confidence

Finding

The brief specifies Chinese text for section labels and body content, rather than merely defining a visual style. It does not make this language requirement conditional on the user's preference or explain why academic-defense slides must be in Chinese.

Content

No source excerpt is available for this finding.

Requires English slide labels without offering a language choice.

Medium

• Category: Output Handling
• Confidence: 98% confidence

Finding

The typography instructions explicitly require English classification labels, and line L108 reinforces this by requiring 2–4 English tags on certain slides. This imposes an output-language requirement without user opt-in or a documented locale-specific justification.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/dlazy_ppt_runtime.py (reported line 142)May include surrounding context.

python

if args.upgrade:
        cmd.insert(4, "-U")
    print(f"Installing dependencies from: {requirements}")
    subprocess.run(cmd, check=True)
    print(f"Runtime ready: {home}")
    return 0

Tainted flow: 'cmd' from os.getenv (line 138, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/dlazy_ppt_runtime.py (reported line 142)May include surrounding context.

python

if args.upgrade:
        cmd.insert(4, "-U")
    print(f"Installing dependencies from: {requirements}")
    subprocess.run(cmd, check=True)
    print(f"Runtime ready: {home}")
    return 0

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/dlazy_ppt_runtime.py (reported line 179)May include surrounding context.

python

print(f"venv: missing ({python})")
        return False
    code = "import requests, PIL, pptx; print('imports ok')"
    proc = subprocess.run(
        [str(python), "-c", code],
        stdout=subprocess.PIPE,
        stderr=subprocess.PIPE,

Tainted flow: 'python' from os.getenv (line 230, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/dlazy_ppt_runtime.py (reported line 179)May include surrounding context.

python

print(f"venv: missing ({python})")
        return False
    code = "import requests, PIL, pptx; print('imports ok')"
    proc = subprocess.run(
        [str(python), "-c", code],
        stdout=subprocess.PIPE,
        stderr=subprocess.PIPE,

Static analysis

No suspicious patterns detected.