Security audit

iFLYTEK AI PPT Generator

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a normal third-party PPT generator, but it includes under-disclosed paths that can send user text and local documents to an external service.

Review before installing if you may use sensitive, confidential, regulated, or internal documents. Treat submitted topics, outlines, and any document-based workflow as data that can leave your environment for Xfyun processing; install only if that provider and credential handling are acceptable for your use case.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared skill purpose is narrow, but the detected behavior includes additional remote operations such as fetching templates, generating outlines separately, accepting uploaded documents or URLs, and uploading local files to an external service. This mismatch is dangerous because users may provide the skill with documents or local content without understanding that those materials can be transmitted off-platform, expanding the privacy and data-exposure risk beyond simple topic-to-PPT generation.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This path can upload full document contents from a local file or remote file URL to a third-party API, yet there is no explicit warning, confirmation, or sensitivity check before transfer. Because documents often contain confidential business or personal data, silent off-box upload significantly increases the risk of data leakage and regulatory/privacy violations.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill advertises Python execution and requires environment secrets, but it does not declare an explicit tool scope such as allowed tools or permissions. That omission weakens reviewability and sandbox policy enforcement, especially since the skill also appears to rely on network access and secret-backed external API calls. In this context, unclear capability boundaries make unintended data access or exfiltration harder for users and platforms to detect.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill requires API credentials for a third-party PPT service but does not clearly disclose that user-provided topics and possibly derived content will be sent to that external provider. This creates a meaningful privacy and compliance risk, because users may assume processing is local and unknowingly submit sensitive business, academic, or internal training topics to a remote service.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The create_outline method hard-codes a default language of "cn", causing the skill to prefer a specific locale unless the caller overrides it. The file does not show any user choice or opt-in mechanism for this language preference.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: User-provided topic content is sent to an external PPT generation service without any explicit user-facing disclosure or consent flow in the skill. This is dangerous because users may provide proprietary, personal, or confidential content assuming it stays local, leading to unintended third-party data exposure.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill’s documented purpose is keyword-based PPT generation, but this code also accepts arbitrary local files and remote file URLs and sends them to a third-party API. That creates an unexpected data-ingestion and exfiltration path for sensitive local documents or attacker-chosen remote content, which materially expands the trust boundary beyond the stated capability.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The create_ppt method uses "cn" as the default language, which imposes a locale preference absent any demonstrated user selection. This can conflict with policies requiring user language choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The create_ppt_by_outline method sets the default language to "cn" rather than obtaining an explicit user preference. This is a natural-language locale constraint that is not justified in the file.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Outline content may contain sensitive summaries, internal plans, or structured proprietary information, and it is transmitted to an external API without clear disclosure. Users may not realize that even derived content, not just raw files, is leaving the system and being processed by a third party.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 75% confidence
Finding: The natural-language instructions impose a fixed input style and present examples exclusively in Chinese, which can amount to an implicit language/locale constraint without offering users a choice. The document does not state that other languages are supported or let users opt into a preferred locale.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The manifest only describes generating PowerPoint presentations from topic keywords and does not mention secret or environment access. While credentials may be operationally necessary, directly reading environment variables is an additional capability outside the user-facing purpose and should be explicitly declared if this skill model tracks such capabilities.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.