ClawHub
Back to skill

Security audit

ppt2fig Export

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to do what it says: convert presentation slides into PDF figures, with normal caution around running a local or downloaded converter.

Install only if you are comfortable running ppt2fig on local presentation files. Prefer a trusted or verified ppt2fig executable, be cautious with the unpinned latest-release download, and do not run the helper from directories that may contain untrusted dist/ppt2fig-cli.exe files.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill clearly instructs the agent to invoke shell commands (`ppt2fig`, `ppt2fig-cli`, and `python ... run_ppt2fig.py`) on user-supplied file paths and arguments, but no explicit permissions are declared. This creates a real security gap because an orchestrator or reviewer may underestimate the skill's execution capabilities, and any unsafe interpolation or future modification could turn this into command execution abuse or unintended local file access.

Static analysis

No suspicious patterns detected.