Double6 PPT CLI

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:26 PM UTC
• Version: 0.4.2

Overview

This PPTX skill is mostly coherent, but it packages broader presentation automation and an unverified npm bootstrap path that users should review before installing.

Install only if you are comfortable with a PPTX tool that can create local run artifacts, invoke OfficeCLI/LibreOffice/PowerPoint automation, and bootstrap an npm dependency. Prefer running it in a constrained workspace, review the OfficeCLI package source/integrity before bootstrap, and avoid treating the vendored nested ppt-master SKILL.md as a separate active skill unless you intentionally want those broader workflows.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/double6_ppt_cli/bootstrap.py:44
• Finding: Network-Fetched npm Dependency Executes Unverified Lifecycle Scripts<![CDATA[ ## Vulnerability Details **File Location**: `scripts/double6_ppt_cli/bootstrap.py:44-50` **Vulnerability Type**: Supply-chain integrity weakness and lifecycle-script execution **Risk Level**: Medium ### Vulnerable Code ```python proc = subprocess.run( [npm, "install", "--ignore-scripts=false", "--save-exact", f"@officecli/officecli@{OFFICECLI_PIN_VERSION}"], cwd=node_dir, capture_output=True, text=True, timeout=900, ) ``` ### Technical Analysis The bootstrap operation installs `@officecli/officecli` from an npm registry and explicitly enables npm lifecycle scripts through `--ignore-scripts=false`. Although the dependency is pinned to version `1.0.144`, a version pin does not independently authenticate the downloaded tarball or its transitive dependencies. `UPSTREAM_LOCK.json` records the expected package identity, source repository, release tag, and commit, but the reviewed data does not include an npm tarball integrity value or a complete integrity-locked transitive dependency graph. The bootstrap code also does not verify downloaded package bytes against a committed digest before lifecycle scripts are allowed to execute. This is not evidence that the currently published OfficeCLI package is malicious. It is a supply-chain control gap: if the registry artifact, publisher account, registry resolution path, or a transitive dependency were compromised, installation-time code could run before the Skill verifies its provenance. The explicit user authorization requirement in `bootstrap.py:18-19` reduces unexpected installation risk, and the exact version pin reduces exposure to arbitrary future releases. Neither control, however, provides content integrity for the artifact that npm ultimately executes. ### Attack Path 1. An attacker compromises the npm publisher account, registry artifact, dependency-resolution infrastructure, or an applicable transitive dependency. 2. Malicious installation logic is introduced into the packag ...[truncated 1188 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Commit an npm lockfile containing exact package versions, resolved registry URLs, and integrity hashes for the complete dependency graph. 2. Use `npm ci` rather than `npm install` so installation fails when the lockfile and declared dependencies differ. 3. Install dependencies with lifecycle scripts disabled by default: ```bash npm ci --ignore-scripts ``` 4. If OfficeCLI requires an installation script, identify and review that script explicitly, then invoke only the minimum required setup operation after integrity verification. 5. Record the expected npm tarball SHA-256 or Subresource Integrity value in the project lock metadata and verify the downloaded artifact before extraction or execution. 6. Configure npm to use an explicitly approved registry and reject unexpected package sources. 7. Run bootstrap in a restricted environment with minimal filesystem permissions, a sanitized environment, and network access limited to approved package endpoints. 8. Ensure the referenced Python dependency lock is included in the distributed package and contains fully pinned dependencies with cryptographic hashes. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (157)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: If the implementation truly supports undeclared audio/narration embedding, transition/timing mutation, and PPTX-to-Markdown export while the description says it does not handle TTS/video-related functions, users may grant trust under false assumptions. Undisclosed content export and media-handling features enlarge the attack surface, can exfiltrate presentation content into derivative files, and can introduce unexpected active content into output decks.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: If the implementation truly supports undeclared audio/narration embedding, transition/timing mutation, and PPTX-to-Markdown export while the description says it does not handle TTS/video-related functions, users may grant trust under false assumptions. Undisclosed content export and media-handling features enlarge the attack surface, can exfiltrate presentation content into derivative files, and can introduce unexpected active content into output decks.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: If the implementation truly supports undeclared audio/narration embedding, transition/timing mutation, and PPTX-to-Markdown export while the description says it does not handle TTS/video-related functions, users may grant trust under false assumptions. Undisclosed content export and media-handling features enlarge the attack surface, can exfiltrate presentation content into derivative files, and can introduce unexpected active content into output decks.

Credential Access

High

• Category: Privilege Escalation

Content

def _capture_html_preview(_client: OfficeCLI, _pptx: Path, _screenshot: Path) -> dict[str, Any]:
    # Chrome-based OfficeCLI preview is intentionally disabled. On macOS its
    # isolated profile can trigger Keychain dialogs, while PowerPoint is already
    # the required rendering fact source later in the workflow.
    return {
        "status": "deferred_to_powerpoint",

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

return {
        "status": "deferred_to_powerpoint",
        "fact_source": "powerpoint_required",
        "reason": "chrome_preview_disabled_to_avoid_keychain_prompts",
    }

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

return {
        "status": "deferred_to_powerpoint",
        "fact_source": "powerpoint_required",
        "reason": "chrome_preview_disabled_to_avoid_keychain_prompts",
    }

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The requirements file advertises and enables capabilities that materially exceed or contradict the declared skill scope, including PDF/DOCX parsing, web fetching, TTS, and AI image generation. This kind of scope drift expands the attack surface and can cause an agent or operator to install and expose code paths they did not intend to trust for a PPTX-focused skill.

Credential Access

High

• Category: Privilege Escalation

Content

# ============================================================

USER_CONFIG_DIR = Path.home() / '.ppt-master'
USER_ENV_FILE = USER_CONFIG_DIR / '.env'


def get_env_candidates() -> list[Path]:

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# ============================================================

USER_CONFIG_DIR = Path.home() / '.ppt-master'
USER_ENV_FILE = USER_CONFIG_DIR / '.env'


def get_env_candidates() -> list[Path]:

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# ============================================================

USER_CONFIG_DIR = Path.home() / '.ppt-master'
USER_ENV_FILE = USER_CONFIG_DIR / '.env'


def get_env_candidates() -> list[Path]:

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# ============================================================

USER_CONFIG_DIR = Path.home() / '.ppt-master'
USER_ENV_FILE = USER_CONFIG_DIR / '.env'


def get_env_candidates() -> list[Path]:

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

def get_env_candidates() -> list[Path]:
    """Return the supported .env lookup order."""
    return [
        Path.cwd() / '.env',
        PROJECT_ROOT / '.env',

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

def get_env_candidates() -> list[Path]:
    """Return the supported .env lookup order."""
    return [
        Path.cwd() / '.env',
        PROJECT_ROOT / '.env',

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

def get_env_candidates() -> list[Path]:
    """Return the supported .env lookup order."""
    return [
        Path.cwd() / '.env',
        PROJECT_ROOT / '.env',

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

def get_env_candidates() -> list[Path]:
    """Return the supported .env lookup order."""
    return [
        Path.cwd() / '.env',
        PROJECT_ROOT / '.env',

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

def get_env_candidates() -> list[Path]:
    """Return the supported .env lookup order."""
    return [
        Path.cwd() / '.env',
        PROJECT_ROOT / '.env',

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

def get_env_candidates() -> list[Path]:
    """Return the supported .env lookup order."""
    return [
        Path.cwd() / '.env',
        PROJECT_ROOT / '.env',

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

def get_env_candidates() -> list[Path]:
    """Return the supported .env lookup order."""
    return [
        Path.cwd() / '.env',
        PROJECT_ROOT / '.env',

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

return destination

    def _run_tool(self, args: list[str]) -> None:
        child_env = os.environ.copy()
        child_env["PYTHONUTF8"] = "1"
        child_env["PYTHONIOENCODING"] = "utf-8:replace"
        try:

• Confidence: 60% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The CLI explicitly supports importing HTTP(S) URLs and converting remote content, which conflicts with the stated skill scope that says it is not responsible for network-based fetching. In an agent setting, this creates an SSRF/data-exfiltration surface by allowing untrusted prompts or inputs to trigger requests to arbitrary endpoints, including internal services if the underlying converter fetches content server-side.

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

sy: Y scale factor.
            transform_matrix: Full affine transform to accumulate for
                converters that can faithfully map it to DrawingML.
            filter_id: Override filter ID.
            style_overrides: Style attribute overrides from child element.
            opacity_multiplier: Local group opacity to multiply into descendants.
        """

• Confidence: 90% confidence
• Finding: Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill advertises substantial capabilities (environment access, file read/write, shell use, and likely bootstrap/network activity) but does not declare an explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and makes it harder for a host or reviewer to constrain execution, increasing the chance of unintended file/system access or package installation beyond the user’s expectation.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This markdown template presents its primary instructions and field labels in Chinese, which effectively forces a specific language for users filling out the skill artifact. The file does not offer an opt-in language choice or explain that the template is intended only for a Chinese-language workflow, which creates a natural-language policy concern.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The document content is written entirely in Chinese and does not indicate that language selection is optional or configurable. Under the policy rule for language/locale constraints, this is a natural-language policy concern because it imposes a specific language without documented user opt-in or justification.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The file’s instructional content is written entirely in Chinese and contains normative requirements without indicating that language choice is optional. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/double6_ppt_cli/template_workflow.py:180