PPT制作

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 2:28 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward PowerPoint generation helper with ordinary local file output and no evidence of hidden execution, exfiltration, persistence, or privilege escalation.

Install in a virtual environment, consider pinning python-pptx and Pillow, and review or override output paths before running --openclaw because that mode writes to a fixed Desktop path on Windows.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Third-Party Dependencies Create Supply-Chain Exposure

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 15
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash

pip install python-pptx pillow

The installed packages are imported by the application in ppt_maker.py:

python

from pptx import Presentation
from PIL import Image

Technical Analysis

The installation command does not constrain either dependency to a reviewed version and does not verify package integrity through cryptographic hashes. Consequently, installation results can change over time and depend on the package index configured in the user's environment.

The package names are consistent with the application's documented purpose, and the reviewed project contains no evidence of typosquatting, an intentionally malicious package, or an untrusted custom package index. Nevertheless, an upstream package compromise, malicious release, package-index compromise, or unsafe local index configuration could cause attacker-controlled code to be installed.

Python packages may execute code during installation or when imported. Because ppt_maker.py imports both dependencies during startup, malicious code introduced into either dependency would be reachable when the application runs.

Attack Path

1. An attacker compromises an upstream dependency release, the package index, or the package source selected by the user's pip configuration.
2. The user follows the documented command in SKILL.md.
3. Pip resolves and installs the attacker-controlled dependency version because no approved version or integrity hash is specified.
4. The user starts ppt_maker.py.
5. The script imports pptx and PIL, triggering any malicious import-time behavior contained in the compromised package.
6. The payload executes with the same operating-system privileges and environmental access as the user running pip or the presentation generator. ...[truncated 655 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin both dependencies to versions that have been reviewed and tested, preferably in a dedicated requirements file or lock file.
2. Generate and verify cryptographic hashes for all direct and transitive dependencies. Install with pip install --require-hashes -r requirements.txt.
3. Explicitly document and enforce a trusted package index rather than relying on potentially unsafe user-level pip configuration.
4. Use an automated dependency update process that reviews security advisories and tests upgrades before changing pinned versions.
5. Run installation and presentation generation in an isolated virtual environment or container under a non-privileged account.
6. Add dependency vulnerability and provenance scanning to continuous integration.
7. Avoid installing dependencies with administrator or root privileges.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The natural-language description forces a specific language for core usage information, and the file does not provide an explicit option for other languages or indicate that Chinese is a required locale. This can violate language/locale policy when users are not given a choice or notice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script’s --openclaw path writes a file directly to a hard-coded Desktop location without user confirmation or an explicit output argument. In an agent or automated execution context, this causes unexpected filesystem side effects, can overwrite an existing file, and leaks assumptions about the host environment and user profile path.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

Natural-language strings in the module docstring and CLI help text present the tool in Chinese only, which effectively forces a language/locale without user opt-in. The policy allows locale constraints only when they are justified or when the user is offered a choice, neither of which is present here.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.