T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
references/design-tokens.md:47- Finding
Unbounded Local File Discovery and Unreviewed Code Reuse
- Content
View full analysis
- Remediation
View remediation
Security audit
html-based slides
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a legitimate corporate slide generator, but it relies on unspecified prior presentation files and remote font resources in ways users should review before installing.
Install only if you are comfortable reviewing generated decks for external font links and confirming any source presentation used for copied logos or JavaScript. Prefer the Neutral preset or provide explicit, trusted asset paths when handling confidential corporate material.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
references/design-tokens.md:12- Finding
Remote Google Fonts Dependency in Purportedly Self-Contained Presentations
- Content
View full analysis
``` From `references/design-tokens.md:61`: ```html ``` The dependency contradicts the following requirements from `SKILL.md:8,12,205`: ```markdown Create zero-dependency, interactive HTML presentations that run in any browser. Every output is a single self-contained HTML file with built-in navigation, commenting, editing, and presentation capabilities. ``` ```markdown 1. **Zero Dependencies** — Single HTML file with inline CSS/JS. No npm, no build tools. ``` ```markdown 1. **Single self-contained HTML file** — all CSS/JS inline ``` ### Technical Analysis Generated presentations are instructed to include stylesheet and preconnection links to Google-hosted services. Opening such a presentation causes the browser to contact `fonts.googleapis.com` and `fonts.gstatic.com`, even though the Skill represents its output as zero-dependency and self-contained. The remote stylesheet and font resources are not bundled, version-pinned by immutable content hash, or protected by Subresource Integrity metadata. Their availability and returned content remain under the control of external infrastructure after the deck has been generated and audited. ...[truncated 1705 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill’s activation text is very broad and matches many generic presentation-related requests, which increases the chance of unintended invocation. In an agent system, over-broad routing can cause the model to enter this skill when the user did not explicitly ask for slide generation, leading to inappropriate file creation, extra processing, or accidental exposure of user content into a presentation workflow.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 2. Technical terms, product names, and code snippets stay unchanged across both languages (e.g. "SKILL.md", "SuperAgent", "CLI", variable names)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Defaulting to bilingual EN/CN output without explicit user opt-in can cause unnecessary transformation and duplication of user-provided content. In enterprise contexts, this may introduce privacy, compliance, or accuracy risks if sensitive material is translated by default or if the user expected a single-language output.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill operationalizes automatic bilingual generation as a default behavior, reinforcing automatic translation without affirmative consent. Because this skill is meant for business reviews, roadmaps, and post-mortems, the content is likely to include internal metrics or incident details, making silent translation more sensitive and potentially more harmful.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The component documentation explicitly encourages setting screenshot
srcto a remote URL or base64 data URI without any warning about privacy, provenance, or data handling. In a corporate slide-generation skill, this can lead users or downstream agents to embed internal screenshots in externally hosted resources or oversized inline blobs, causing unintentional data exposure, external fetches to third parties, and leakage of sensitive operational details.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file explicitly instructs consumers to load Google Fonts from external domains, which causes client browsers to make third-party network requests when viewing generated slide decks. That can leak viewer IP address, user agent, timing, and referrer/context to Google without disclosure or consent, which is a real privacy and compliance issue in a corporate presentation skill.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This markdown file documents behaviors that can affect user data: language preference persistence, per-slide notes saved to localStorage, and inline editing of slide content. The feature list and implementation notes describe these actions functionally but do not warn users that data will be stored locally or that slide content can be modified in-browser.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The natural-language comments specify that the default language is 'cn' and that the body starts with class lang-cn. This establishes a specific language preference by default rather than presenting a neutral initial choice or explicit opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The bilingual toolbar marks the CN option as active by default, which imposes a specific language selection in the provided template rather than offering a neutral default or explicit user choice first. This is a natural-language locale policy concern because the file defines presentation chrome behavior and preselects one language without documenting opt-in or justification.
- Content