ClawHub
Back to skill

Security audit

Emergence PPT Orchestra

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent presentation generator, but it should be reviewed because it can upload user-derived diagram content to a third-party render service while claiming human intellectual property stays local, and it runs an unpinned Marp package at build time.

Install only if you are comfortable sending diagram definitions or data-derived visual content to Emergence's render service. Avoid using it with confidential strategy, customer data, unpublished research, or proprietary architecture unless you explicitly approve the upload and have reviewed the service's handling of that data. Prefer a pinned, locally installed Marp CLI instead of the documented @latest npx commands.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:65
Finding

Runtime Execution of an Unpinned Marp CLI Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 65–72
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code

bash
# Convert to PDF
npx @marp-team/marp-cli@latest presentation.md --pdf -o out.pdf

# Convert to PowerPoint
npx @marp-team/marp-cli@latest presentation.md --pptx -o out.pptx

# Convert to HTML
npx @marp-team/marp-cli@latest presentation.md -o out.html

Technical Analysis

The documented compilation workflow instructs the agent to execute @marp-team/marp-cli@latest through npx. The latest tag is mutable and does not identify a specific, previously reviewed package version. If the package, its publishing account, or an upstream dependency is compromised, subsequent skill executions can retrieve and run different code without any change to this audited project.

npx may download the selected package and execute its entry point and package lifecycle behavior locally. Consequently, this is a third-party supply-chain execution boundary rather than a reproducible local build process.

Attack Path

  1. An attacker compromises the package publisher, registry account, release pipeline, or a relevant upstream dependency.
  2. The attacker publishes a malicious release and causes the mutable latest tag to resolve to it.
  3. A user or agent follows the compilation instructions in SKILL.md.
  4. npx retrieves the currently tagged package from the registry.
  5. The downloaded package executes under the privileges of the user or agent running the skill.
  6. Malicious package code can access resources available to that process, including presentation files, other readable local files, environment variables, and permitted network services.

Impact Assessment

Successful exploitation can result in arbitrary code execution with the privileges of the invoking user or agent. The practical scope may include reading or modifying files acc ...[truncated 260 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace @latest with an exact, reviewed Marp CLI version.
  2. Declare the dependency in a package manifest and commit a lockfile so all transitive versions are reproducible.
  3. Install dependencies in a controlled installation step and invoke the locally installed binary rather than allowing ad hoc runtime resolution.
  4. Enforce package integrity verification through the lockfile and trusted-registry configuration.
  5. Review dependency updates before changing the pinned version, preferably using automated supply-chain scanning.
  6. Run presentation compilation in a sandbox with minimum filesystem access, restricted network connectivity, and no unnecessary credentials in the environment.

Example hardened workflow:

bash
npm ci --ignore-scripts
npx --no-install marp presentation.md --pdf -o out.pdf
npx --no-install marp presentation.md --pptx -o out.pptx
npx --no-install marp presentation.md -o out.html

The exact reviewed version of @marp-team/marp-cli should be declared in package.json and resolved by a committed lockfile.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The README states that complex diagram data is sent to an external rendering service at api.emergence.science. This creates a real data exfiltration boundary: prompts, diagrams, architecture details, or proprietary content included in slide generation may be transmitted to a third party, which is risky in an autonomous-agent context where sensitive input may be forwarded without sufficient user awareness.

Content

Scanner excerpt · README.md (reported line 12)May include surrounding context.

md
1. **Iterative Structuring**: Prevents LLM hallucinations by forcing a human-in-the-loop outline approval process.
2. **Markdown-Based Architecture**: Slides are written transparently in `presentation.md` utilizing standard Marp directives (`---` slide breaks, `--paginate`, CSS styles).
3. **Custom Branding Allowed**: The skill explicitly tells the agent to ask for and use your company's generic HTML `<style>` tags rather than enforcing our own brand on your slides.
4. **Visual Cortex Integration**: Directly pipes complex data structures (TikZ, Mermaid, Graphviz, D2) to `https://api.emergence.science/tools/render`, injecting academic-grade images seamlessly into your deck.
5. **Multi-Format Compilation**: Wraps `@marp-team/marp-cli` to construct `.pdf`, `.pptx`, or `.html`.

## 📦 Installation

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill directs the agent to send presentation-related content to an external API but does not clearly require a user-facing disclosure or consent step before uploading potentially sensitive text, concepts, or CSV-derived data. In a presentation-generation context, inputs often include confidential strategy, research, or customer information, making silent exfiltration materially risky.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

Referencing and instructing direct use of an external render API establishes a workflow that sends user-derived content off the local system. In this skill's context, that is not inherently malicious, but it is security-relevant because presentations frequently contain proprietary or sensitive information and the skill does not sufficiently bound or warn about disclosure.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

Phase 3: The "Visual Cortex" (Emergence Render API)

If the presentation requires data visualizations, flowcharts, or scientific plots (e.g., from CSVs or concepts), do not use ASCII art.

  • Action: Invoke the https://api.emergence.science/tools/render API via POST.
  • Engines Available: tikz, mermaid, graphviz, d2.
  • Payload Example:
    bash

External Transmission

Medium
Category
Data Exfiltration
Confidence
82% confidence
Finding

The HTTPS endpoint in the example is another instance of the same outbound transmission behavior: the agent is instructed to POST render inputs to a third-party service. The danger is contextual rather than inherently malicious—remote rendering can expose confidential business, academic, or research material if used without informed consent and data minimization.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

  • Engines Available: tikz, mermaid, graphviz, d2.
  • Payload Example:
    bash
    curl -s -X POST https://api.emergence.science/tools/render \
  -H "Authorization: Bearer $EMERGENCE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
82% confidence
Finding

The HTTPS endpoint in the example is another instance of the same outbound transmission behavior: the agent is instructed to POST render inputs to a third-party service. The danger is contextual rather than inherently malicious—remote rendering can expose confidential business, academic, or research material if used without informed consent and data minimization.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

  • Engines Available: tikz, mermaid, graphviz, d2.
  • Payload Example:
    bash
    curl -s -X POST https://api.emergence.science/tools/render \
  -H "Authorization: Bearer $EMERGENCE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The skill instructs use of npx @marp-team/marp-cli@latest, which fetches and executes a package at runtime without a fixed version. This creates a supply-chain risk: a compromised upstream release or unexpected breaking change could lead to arbitrary code execution in the agent environment during compilation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The PowerPoint compilation step also uses npx @marp-team/marp-cli@latest, causing runtime retrieval and execution of unpinned code. In an agent skill context this is especially risky because the build command may be executed automatically on untrusted or semi-trusted input, expanding supply-chain exposure.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The HTML compilation command repeats the same unpinned npx pattern, so every output mode inherits the same package-supply-chain execution risk. Because npx resolves packages from the registry at execution time, a future malicious or compromised release could execute arbitrary code under the agent's privileges.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The privacy statement claims that all slide text and human intellectual property remain local, yet the documented workflow sends diagram code, CSV-derived content, or conceptual descriptions to a remote render API. This is dangerous because it can mislead users and operators into disclosing sensitive material under false privacy assurances.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · manifest.json (reported line 13)May include surrounding context.

json
},
  "api": {
    "type": "openapi",
    "url": "https://api.emergence.science/tools/render/openapi.json"
  },
  "discovery": {
    "content_index": "https://emergence.science/content/index.json"

Static analysis

No suspicious patterns detected.