PowerPoint Automation

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 6:54 AM UTC
• Version: 0.1.0

Overview

This skill is a straightforward Windows PowerPoint/WPS automation helper, with ordinary file read/write risks but no hidden persistence, credential access, network execution, or unrelated behavior found.

Install this only in a normal, non-admin Python environment and consider pinning pywin32. Use explicit output/save paths, keep backups before delete/replace/font/theme actions, and avoid exporting notes or slide text from sensitive presentations unless you intend to write that content to disk.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 14
Vulnerability Type: Unpinned and unverifiable third-party dependency
Risk Level: Medium

markdown

- Python + **pywin32** (`python -m pip install pywin32`).

Technical Analysis

The setup documentation instructs users to install pywin32 without specifying a reviewed version, cryptographic hash, trusted package index, or lock file. Consequently, the installed dependency may change over time and may be obtained from a package source configured outside the project's control.

The project does not automatically execute this installation command, and no malicious dependency is present in the audited files. Nevertheless, if the package registry, a configured package mirror, or a future dependency release is compromised, following the documented command could install and execute attacker-controlled package code.

Attack Path

1. An attacker compromises the relevant package release, package registry, or Python package mirror used by the victim.
2. The user follows the documented setup instruction and runs python -m pip install pywin32.
3. Pip resolves the dependency from the compromised source without enforcing an audited version or expected artifact hash.
4. Malicious installation or runtime code executes with the privileges of the user running pip.
5. The attacker may access or modify resources available to that user, subject to operating-system controls.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the account performing the installation. The resulting scope may include that user's files, accessible presentations, Python environment, and other resources available to the account. Administrative or system-level impact would require the installation to be run from an elevated context; the audited project itself does not request or obtain elevation.

Remediation

View remediation

Remediation Suggestions

1. Pin pywin32 to a specifically reviewed version instead of installing the latest available release.
2. Store dependencies in a version-controlled requirements or lock file.
3. Record and enforce cryptographic hashes with pip's --require-hashes option.
4. Use an explicitly configured, trusted package index and disable unintended fallback indexes where appropriate.
5. Review and update the pinned dependency through a controlled dependency-update process.
6. Prefer installation in an isolated virtual environment under a non-administrative account.

Example hardened installation pattern:

text

pywin32==<reviewed-version> --hash=sha256:<verified-artifact-hash>

bash

python -m pip install --require-hashes --index-url https://pypi.org/simple -r requirements.txt

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The code substantially matches the declared purpose and scope: it is a Windows COM automation tool for single-presentation PowerPoint/WPS operations, and it implements most listed actions. However, there are two notable description/behavior gaps. First, the description claims it can extract 'images/media', but the implementation only exports shapes of picture types and does not handle general embedded media such as audio/video. Second, 'read ... outline' suggests fuller outline extraction, while the implementation merely lists each slide index and title. There are no obvious undeclared harmful capabilities, no batch processing, and no unrelated triggers or resource access. The mismatch is therefore limited but real because the declared capabilities overstate what is implemented.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill exposes file-modifying capabilities such as saving modified presentations, exporting files, and extracting images, but it does not declare any explicit tool scope or permission boundaries. In an agent environment, missing scope metadata can cause the skill to be invoked without clear user-consent or policy controls for file writes, increasing the chance of unintended local file modification or creation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill documents destructive and state-changing operations like delete-slide, replace, font unification, and theme application without clearly warning that they can alter or remove user data. In an agent-driven workflow, that omission increases the risk that a user or higher-level agent triggers irreversible modifications to important presentation files without adequate caution or backup steps.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The read command extracts slide text from the presentation and writes it to a user-specified file when --output is provided. Although file output is part of the command behavior, this code path has no confirmation prompt, logging, or explanatory comment/docstring disclosing that presentation contents will be persisted to disk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The notes command extracts speaker notes and saves them to disk when --output is supplied. Speaker notes can contain sensitive internal material, but the code provides no confirmation, visible log, or descriptive warning that this content is being persisted.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.