slide-maker

• Outcome: Review
• Latest audit: Jul 22, 2026 · 6:50 AM UTC
• Version: 3.9.0

Overview

This slide-deck skill is mostly coherent, but it warrants Review because it combines broad file/web/tool authority with persistent profiling and unsandboxed generated Python/HTML execution paths.

Install only if you are comfortable with a slide agent reading source files you provide, doing web/API research, running local render/build scripts, and storing small preference/template records under your home directory. Review generated Python style/section files and local preview HTML before using them with untrusted inputs, and require explicit approval before paid OpenAI API image generation or saving reusable looks/profiles.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (20)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# reaches here, so no local file can be read and no JS/SSRF can run. --disable-remote-fonts
            # blocks any web-font egress; we deliberately do NOT pass --blink-settings=scriptEnabled=false
            # because it silently breaks the headless screenshot on current Chrome (produces no file).
            subprocess.run([chrome, "--headless", "--disable-gpu", f"--screenshot={out_png}",
                            "--disable-remote-fonts",
                            f"--window-size={px},{px}", "--force-device-scale-factor=3",
                            "--default-background-color=00000000", "--hide-scrollbars",

• Confidence: 87% confidence
• Finding: subprocess.run([chrome, "--headless", "--disable-gpu", f"--screenshot={out_png}", "--disable-remote-fonts", f"--window-size={px},{px

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares no permissions while explicitly instructing use of shell, filesystem, environment inspection, and network/web tooling. This under-specification is dangerous because users and host runtimes may not realize the skill can read/write local files, persist data, and invoke external tools, weakening consent and sandbox policy enforcement.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence
• Finding: The public description presents a slide-building skill, but the body authorizes a much broader operational surface: document extraction, registry persistence, rendering pipelines, installation, web fetching, and image generation. That mismatch is risky because it can trigger unexpectedly privileged behavior under a benign-seeming label, increasing the chance of overbroad invocation and unnoticed access to user files or services.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill instructs reading and writing persistent preference data in `taste.md` across sessions. Persistent profiling beyond immediate task execution can expose sensitive user preferences, create unreviewed memory, and cause future actions to be steered by stored data the user may not expect or remember exists.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: Saving templates and generated profiles into a persistent registry writes user-derived artifacts outside the immediate deliverable folder. This expands data retention and can accumulate sensitive branded materials or prior work products without strong consent boundaries.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The helper loads and executes arbitrary Python from a caller-supplied path via importlib, which means any top-level code in the style file runs with the process's privileges before slide generation begins. In a slide-making skill, style selection should be data-driven; executing untrusted Python is broader than necessary and creates a code-execution boundary that could be abused if style files can come from users, shared workspaces, or compromised repositories.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The script inserts `cover_motif` directly into the generated HTML without escaping or sanitization. Because this page is meant to be opened locally in a browser and direction objects can be synthesized or influenced by user input, an attacker could inject script-bearing HTML or event handlers, leading to DOM XSS in the preview page and possible access to local file context or clipboard interactions available to that page.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: The script embeds `ambient_motif` as raw HTML into every interior slide without sanitization. This multiplies the attack surface because a malicious payload would be repeated throughout the generated document, and in this skill's workflow the 'describe your own' path explicitly contemplates generating new direction token sets from user text, making attacker-controlled HTML injection plausible.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The assembler imports and executes arbitrary Python files supplied in section_paths via spec.loader.exec_module(mod), which gives those files full code execution with the privileges of the running process. In this skill’s context, sections may be independently authored by subagents or derived from user-controlled content, so treating section files as trusted code substantially increases the risk of malicious payloads, data exfiltration, or destructive local actions during deck assembly.

Vague Triggers

High

• Confidence: 91% confidence
• Finding: The trigger language is intentionally broad enough to fire on many common presentation-adjacent requests, including cases where the user may only want critique, extraction, or general help. Overbroad triggering is dangerous here because the skill carries file, shell, network, and persistence behaviors, so accidental invocation can lead to excessive tool use and data handling beyond user intent.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The default prompt is highly generic and pairs with implicit invocation, making it easy for unrelated user requests about topics, documents, or reviews to trigger the slide-making skill unexpectedly. In a skill that can mine source material and perform web research, overly broad triggering increases the chance of unnecessary access to sensitive context, accidental autonomous actions, or prompt-routing to a more capable workflow than the user intended.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The skill hardcodes a Chinese-language requirement ('的风格要走所有页') as a mandatory design-check criterion without any user opt-in or language-appropriateness check. This can cause the agent to emit non-user-requested Chinese in outputs or enforce language-specific behavior that may confuse users, break downstream automation expecting a single language, or create prompt-injection-like policy drift from the user's stated language.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This path dynamically executes a style module without any warning, confirmation, or trust check, so a user or upstream component may believe they are merely previewing slide formatting when they are actually running arbitrary code. That mismatch is especially risky in an agent skill context where files may be user-provided and automation may invoke the preview step non-interactively.

Missing User Warnings

Low

• Confidence: 74% confidence
• Finding: The choropleth smoke test invokes a code path that may fetch and cache remote geometry data when local base geometry is unavailable. Even though this appears intended for test coverage rather than abuse, network access during a build/test path can create unexpected outbound requests, leak execution metadata such as IP or environment timing, and reduce reproducibility in restricted environments.

External Transmission

Medium

• Category: Data Exfiltration

Content

from pathlib import Path


API_URL = "https://api.openai.com/v1/images/generations"
DEFAULT_MODEL = "gpt-image-2"
DEFAULT_SIZE = "2048x1152"
DEFAULT_QUALITY = "medium"

• Confidence: 90% confidence
• Finding: https://api.openai.com/

Session Persistence

Medium

• Category: Rogue Agent

Content

- Precedence — the profile seeds, it never decides
- The schema — fixed sections, HARD CAPS (whole file ≤ ~500 tokens)
- READ protocol
- WRITE protocol — conservative by construction (Step 6 only)
- Why this shape

## Where it lives — and the empty-file rule

• Confidence: 94% confidence
• Finding: WRITE protocol — conservative by construction (Step 6 only) - Why this shape ## Where it lives — and the empty-file rule `taste.md` sits at the **active template-registry ROOT** — `~/.claude/slide-te

Unpinned Dependencies

Low

• Category: Supply Chain

Content

python-pptx>=1.0.0
PyMuPDF>=1.24.0
Pillow>=10.0.0
matplotlib>=3.8.0

• Confidence: 95% confidence
• Finding: python-pptx>=1.0.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

python-pptx>=1.0.0
PyMuPDF>=1.24.0
Pillow>=10.0.0
matplotlib>=3.8.0

• Confidence: 95% confidence
• Finding: PyMuPDF>=1.24.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

python-pptx>=1.0.0
PyMuPDF>=1.24.0
Pillow>=10.0.0
matplotlib>=3.8.0

# Optional (feature-gated; scripts degrade gracefully without them):

• Confidence: 97% confidence
• Finding: Pillow>=10.0.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

python-pptx>=1.0.0
PyMuPDF>=1.24.0
Pillow>=10.0.0
matplotlib>=3.8.0

# Optional (feature-gated; scripts degrade gracefully without them):
#   cairosvg>=2.7      — SVG icon rasterization fallback when Chrome/Chromium is absent

• Confidence: 95% confidence
• Finding: matplotlib>=3.8.0

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/archetypes.py:42

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/assemble.py:52