深知可信PPT

• Outcome: Review
• Latest audit: Sep 2, 2026 · 6:39 AM UTC
• Version: 1.1.0

Overview

The PPT-generation purpose is coherent, but the skill’s phone-based onboarding can create or retrieve long-lived API keys and is not plainly disclosed to users at runtime.

Review before installing. This skill can ask for phone verification with Beijing Caizhi/dknowc, create or retrieve an access key, send search terms to dknowc services, write project/report/export files locally, and retain backups of source slides. Prefer using a pre-provisioned secret, avoid requesting new keys unless needed, do not persist the key unless you intend to, and delete project backups when working with confidential materials.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The notice explicitly states that the skill removed the upstream compiler's integrity and secondary identity verification mechanisms. In a skill marketed as 'trusted' and 'fully traceable,' disabling provenance or anti-tamper checks materially weakens assurance about artifact authenticity and increases the risk of unauthorized or misleading PPT generation behavior going undetected.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This helper performs SMS sending, user registration, and API key provisioning for an external platform, which is materially broader than the declared PPT-generation/search behavior of the skill. In a skill context, this creates an unnecessary credential-management and account-lifecycle surface that could be abused to create or rotate access for third-party services without clear user understanding or need.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The register path collects phone numbers and verification codes, creates accounts, and can mint additional API keys via the open API. For a PPT-making skill, these capabilities are not justified by core functionality and enable privileged actions on behalf of the user that extend beyond document generation into identity and secret management.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The opening comment states the script only returns a key for the current task and never writes local files, but the implementation can register new accounts and create additional API keys that may remain valid long after the task ends. This mismatch can mislead reviewers and users about the persistence and scope of the actions being performed, reducing informed consent around sensitive credential operations.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The animation sound path validator accepts absolute paths for object-animation sounds and resolves them directly, unlike transition sounds which are constrained to be project-relative and project-contained. In a system that processes untrusted project content, this broadens filesystem reach and can disclose file existence or ingest unintended local files into the generated PPT/package, violating least-privilege expectations for a config helper.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code intentionally grants the built-in Windows Users group read access to every exported PPTX file. In a multi-user host or shared workstation, this can expose generated presentations containing sensitive material to unintended local users, which is especially relevant for a PPT-generation skill that may process confidential reports or policy content.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The CLI copies the entire authored svg_output directory and, when present, the native payload store into backup/<timestamp>/ during normal exports. Those artifacts can contain sensitive source content, embedded data, proprietary templates, or payload metadata that users may not expect to be retained, increasing the risk of local data exposure, over-retention, or accidental inclusion in later sharing/backups.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The README instructs users to obtain and use a `DKNOWC_API_KEY` and to send queries through a remote trusted-search service, but it does not clearly warn that user prompts, source materials, and possibly sensitive document content may be transmitted to a third-party service. In a PPT-generation skill, users are likely to provide internal reports, policy drafts, or business materials, so the absence of an explicit privacy/data-handling notice can lead to unintentional disclosure of confidential information.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger conditions are very broad and can capture almost any request related to presentations, reports, or converting materials into slides. Over-broad routing can cause unintended invocation of a high-capability skill that performs network access, local file reads/writes, shell execution, and even credential onboarding flows, increasing the chance of unnecessary data exposure or surprise side effects.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script emits the full API key in JSON on stdout, which is commonly captured by logs, terminals, orchestration layers, or chat transcripts. In an agent or skill environment, this greatly increases the chance of secret disclosure and subsequent unauthorized use of the user's MaaS account.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.