ClawHub
Back to skill

Security audit

Double6 PPT CLI

Security checks for vulnerabilities and agentic risk

Overview

This PPTX authoring and repair skill is mostly coherent and user-directed, with the main caution being its optional external OfficeCLI bootstrap install.

Install this only if you are comfortable with a PPTX tool that writes project/run files and may automate PowerPoint or LibreOffice. Run bootstrap only from a trusted environment because it installs third-party dependencies under your user account, and prefer reviewing or pinning dependency integrity before using the OfficeCLI install path.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
scripts/double6_ppt_cli/bootstrap.py:44
Finding

Unverified npm Lifecycle Scripts Execute During OfficeCLI Bootstrap

Content
View full analysis

Vulnerability Details

File Location: scripts/double6_ppt_cli/bootstrap.py:44-51
Vulnerability Type: Third-party supply-chain code execution
Risk Level: Medium

Vulnerable Code

python
proc = subprocess.run(
    [npm, "install", "--ignore-scripts=false", "--save-exact", f"@officecli/officecli@{OFFICECLI_PIN_VERSION}"],
    cwd=node_dir,
    capture_output=True,
    text=True,
    timeout=900,
)
log.append({"command": f"npm install @officecli/officecli@{OFFICECLI_PIN_VERSION}", "returncode": proc.returncode, "stdout": proc.stdout, "stderr": proc.stderr})
if proc.returncode:
    raise D6PPTError("Pinned OfficeCLI installation failed", "bootstrap_failed", log)

Technical Analysis

The bootstrap process invokes npm install with --ignore-scripts=false, explicitly allowing preinstall, install, and postinstall lifecycle scripts from OfficeCLI or any transitive dependency to execute.

The direct package is pinned to version 1.0.144, and bootstrap requires explicit user authorization. These controls reduce accidental installation and version drift, but they do not provide artifact-level integrity. The reviewed UPSTREAM_LOCK.json records the package version and upstream commit but does not contain an npm tarball digest or npm integrity value. No package lock containing verified transitive dependency integrity values was present in the audited package.

Consequently, bootstrap trusts the package registry and its resolved dependency graph at installation time. If the registry artifact, publisher account, or transitive dependency is compromised, lifecycle code not present during this audit can execute locally.

The absent requirements-core.lock causes a fresh bootstrap to fail at the preceding Python dependency installation step in this artifact. This currently limits reachability through an unmodified package, but it is a packaging defect rather than a reliable security control. If that file is restored—as the implementation e ...[truncated 1392 chars]

Remediation
View remediation

Remediation Suggestions

  1. Disable npm lifecycle scripts by default with --ignore-scripts=true.
  2. If OfficeCLI requires a lifecycle step, identify and review that exact script, then execute only the required operation in a constrained subprocess instead of enabling scripts for the entire dependency graph.
  3. Commit a package lock containing integrity values for the direct package and all transitive dependencies.
  4. Replace npm install with npm ci against the reviewed lockfile.
  5. Record and verify the trusted npm tarball SHA-256 or registry integrity value before installation.
  6. Configure npm to use an explicitly approved registry and reject unexpected package sources, aliases, Git dependencies, and URL dependencies.
  7. Install in a sandbox with minimal filesystem access, a sanitized environment, and network access restricted to the approved registry.
  8. Repair the missing requirements-core.lock packaging issue and ensure all dependency locks are included and validated by the attribution or integrity guard.
  9. Extend the bootstrap receipt to record the lockfile digest, resolved package integrity values, registry origin, and whether lifecycle scripts were disabled.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (156)

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

The code chunk does not implement PPTX generation, templating, reading, inspection, or repair. Instead, it performs software supply-chain/compliance checks: ensuring attribution/license documents exist and that vendored ppt-master-core files match expected hashes from BOM.json. This is a materially different primary purpose from the declared end-user skill description. While such a script could be part of the project’s internal maintenance, the evaluation is for whether the description accurately represents this code chunk’s behavior, and it does not.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

代码的主功能与描述存在明显偏差。该文件专注于对“已有 PPTX”做增强：init/plan/apply/validate 流程中会读取源 PPTX、生成项目目录、导出 source markdown、检查 notes/audio 素材、将 notesSlide 写入包内、拷贝音频到 ppt/media、注入 narration 载体、依据音频时长设置 auto-advance timings，并可修改 slide transitions。它还执行交付检查、动画/转场校验以及输出 postflight 验证。

相比之下，声明描述的是更宽泛的 PPT 生成/模板套用/读取/检查/闭环修复能力，并强调从 Markdown、文本、结构化材料与图片制作演示文稿。这段代码并不负责从 Markdown/文本生成演示文稿，也不实现模板套用；“修复”也仅限非常受控的 notes/audio/timings/transitions 注入与校验，不是通用闭环修复。

更关键的是，代码提供了描述中未明确声明的能力：嵌入音频旁白、设置自动翻页时间、应用页面转场。这些是实质性行为，不只是实现细节。虽然声明提到不负责 TTS 或视频，但并未说明会处理本地音频旁白；代码甚至依赖 ffprobe 来验证音频可解码性与时长。因此，声明不能准确代表该代码块的实际功能范围与重点。

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/double6_ppt_cli/inspector.py (reported line 60)May include surrounding context.

python
def _capture_html_preview(_client: OfficeCLI, _pptx: Path, _screenshot: Path) -> dict[str, Any]:
    # Chrome-based OfficeCLI preview is intentionally disabled. On macOS its
    # isolated profile can trigger Keychain dialogs, while PowerPoint is already
    # the required rendering fact source later in the workflow.
    return {
        "status": "deferred_to_powerpoint",

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/double6_ppt_cli/inspector.py (reported line 65)May include surrounding context.

python
return {
        "status": "deferred_to_powerpoint",
        "fact_source": "powerpoint_required",
        "reason": "chrome_preview_disabled_to_avoid_keychain_prompts",
    }

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/tests/test_template_and_visual.py (reported line 299)May include surrounding context.

python
return {
        "status": "deferred_to_powerpoint",
        "fact_source": "powerpoint_required",
        "reason": "chrome_preview_disabled_to_avoid_keychain_prompts",
    }

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The file explicitly documents and enables TLS fingerprint impersonation to access sites that block standard Python clients, which is an evasion capability unrelated to basic PPT authoring. In an agent setting, this can facilitate bypass of site defenses, fetching of untrusted remote content, and policy circumvention with elevated legal and security risk.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · vendor/ppt-master-core/skills/ppt-master/scripts/config.py (reported line 55)May include surrounding context.

python
# ============================================================

USER_CONFIG_DIR = Path.home() / '.ppt-master'
USER_ENV_FILE = USER_CONFIG_DIR / '.env'


def get_env_candidates() -> list[Path]:

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · vendor/ppt-master-core/skills/ppt-master/scripts/config.py (reported line 61)May include surrounding context.

python
# ============================================================

USER_CONFIG_DIR = Path.home() / '.ppt-master'
USER_ENV_FILE = USER_CONFIG_DIR / '.env'


def get_env_candidates() -> list[Path]:

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · vendor/ppt-master-core/skills/ppt-master/scripts/config.py (reported line 62)May include surrounding context.

python
# ============================================================

USER_CONFIG_DIR = Path.home() / '.ppt-master'
USER_ENV_FILE = USER_CONFIG_DIR / '.env'


def get_env_candidates() -> list[Path]:

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · vendor/ppt-master-core/skills/ppt-master/scripts/config.py (reported line 63)May include surrounding context.

python
# ============================================================

USER_CONFIG_DIR = Path.home() / '.ppt-master'
USER_ENV_FILE = USER_CONFIG_DIR / '.env'


def get_env_candidates() -> list[Path]:

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · vendor/ppt-master-core/skills/ppt-master/scripts/config.py (reported line 59)May include surrounding context.

python
def get_env_candidates() -> list[Path]:
    """Return the supported .env lookup order."""
    return [
        Path.cwd() / '.env',
        PROJECT_ROOT / '.env',

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · vendor/ppt-master-core/skills/ppt-master/scripts/config.py (reported line 70)May include surrounding context.

python
def get_env_candidates() -> list[Path]:
    """Return the supported .env lookup order."""
    return [
        Path.cwd() / '.env',
        PROJECT_ROOT / '.env',

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · vendor/ppt-master-core/skills/ppt-master/scripts/config.py (reported line 72)May include surrounding context.

python
def get_env_candidates() -> list[Path]:
    """Return the supported .env lookup order."""
    return [
        Path.cwd() / '.env',
        PROJECT_ROOT / '.env',

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · vendor/ppt-master-core/skills/ppt-master/scripts/config.py (reported line 83)May include surrounding context.

python
def get_env_candidates() -> list[Path]:
    """Return the supported .env lookup order."""
    return [
        Path.cwd() / '.env',
        PROJECT_ROOT / '.env',

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · vendor/ppt-master-core/skills/ppt-master/scripts/config.py (reported line 90)May include surrounding context.

python
def get_env_candidates() -> list[Path]:
    """Return the supported .env lookup order."""
    return [
        Path.cwd() / '.env',
        PROJECT_ROOT / '.env',

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · vendor/ppt-master-core/skills/ppt-master/scripts/config.py (reported line 120)May include surrounding context.

python
def get_env_candidates() -> list[Path]:
    """Return the supported .env lookup order."""
    return [
        Path.cwd() / '.env',
        PROJECT_ROOT / '.env',

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · vendor/ppt-master-core/skills/ppt-master/scripts/config.py (reported line 123)May include surrounding context.

python
def get_env_candidates() -> list[Path]:
    """Return the supported .env lookup order."""
    return [
        Path.cwd() / '.env',
        PROJECT_ROOT / '.env',

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest says the skill is not responsible for联网搜图 and frames scope around local materials and native PPTX workflows, but this CLI explicitly accepts HTTP(S) URLs, converts them via a web route, and archives URL imports. That is a semantic expansion from local PPT/project management into remote web-content ingestion.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · vendor/ppt-master-core/skills/ppt-master/scripts/project_management/cli.py (reported line 380)May include surrounding context.

python
return destination

    def _run_tool(self, args: list[str]) -> None:
        child_env = os.environ.copy()
        child_env["PYTHONUTF8"] = "1"
        child_env["PYTHONIOENCODING"] = "utf-8:replace"
        try:

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The manifest excludes PDF/DOCX parsing, but the CLI defines dedicated import paths for PDFs and documents and later auto-converts those formats during source import. This is a direct description-behavior mismatch rather than an implementation detail of PPTX generation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest positions the skill around Markdown/text/structured materials/local images plus native PPTX handling, and explicitly excludes PDF/DOCX parsing. This import pipeline automatically processes PDFs and office documents into Markdown and also ingests web URLs, showing broader source-conversion behavior than declared.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
90% confidence
Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · vendor/ppt-master-core/skills/ppt-master/scripts/svg_to_pptx/drawingml/context.py (reported line 207)May include surrounding context.

python
sy: Y scale factor.
            transform_matrix: Full affine transform to accumulate for
                converters that can faithfully map it to DrawingML.
            filter_id: Override filter ID.
            style_overrides: Style attribute overrides from child element.
            opacity_multiplier: Local group opacity to multiply into descendants.
        """

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
83% confidence
Finding

The skill declares substantial capabilities (environment access, file read/write, shell execution, and possible network/bootstrap behavior) but does not publish an explicit tool scope such as permissions or allowed-tools. That creates an authorization ambiguity where an agent may invoke broader actions than a user expects, especially because the document describes bootstrap/install flows and filesystem manipulation across user-accessible directories.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill’s primary description forces a specific language/locale for users by presenting core usage and scope information only in Chinese. Under the policy, locale constraints should either be optional, user-selected, or clearly justified as region-specific; no such opt-in or justification is provided here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The full README-style instruction set is presented only in Chinese, which effectively imposes a language requirement on all users of the skill. The policy allows locale constraints only when users are given a choice or when the restriction is clearly documented and justified for a region-specific tool, which is not done here.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/double6_ppt_cli/template_workflow.py:180