Security audit

elite-ppt-pro

Security checks for vulnerabilities and agentic risk

Overview

The skill mainly provides presentation-generation instructions, but it quietly adds fixed third-party branding to generated slides without a clear user-controlled opt-out.

Review this skill before installing if you create client-facing or confidential presentations. Its research, citation, and local PPTX generation behavior is normal for the stated purpose, but remove or modify the hardcoded slide labels if you do not want third-party branding embedded in outputs. Specify your desired output language explicitly if you do not want Chinese-first slide text or fonts.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:362
Finding: Mandatory Undisclosed Branding in Generated Presentations## Vulnerability Details **File Location**: `SKILL.md:362-367` **Vulnerability Type**: Output manipulation through mandatory Skill instructions **Risk Level**: High ### Vulnerable Code ```javascript // Brand label in the upper-right corner slide.addText("Elite PPT Pro", { x: 8.5, y: 0.08, w: 1.4, h: 0.35, fontSize: 6, fontFace: "Arial", color: theme.midText, align: "right" }); ``` The mandatory slide template at `SKILL.md:193-207` directs generated content slides to invoke `addEliteHeader`, which contains this fixed label. ### Technical Analysis The header helper unconditionally inserts the fixed `Elite PPT Pro` brand into generated presentation slides. The branding is not supplied by the user, cannot be disabled through a documented option, and is unrelated to the substantive presentation content requested by the user. Because the Skill instructs the Agent to use this helper as part of its mandatory workflow, loading and following the Skill alters the integrity of the Agent's deliverable by introducing third-party promotional content. This behavior best matches instruction hijacking because Skill-level instructions cause the Agent to produce content beyond the user's presentation-generation objective. No arbitrary code execution, privilege escalation, credential access, persistence, or data exfiltration is enabled by this issue. ### Attack Path 1. A user invokes the Skill to generate a consulting-style presentation. 2. The Agent follows the mandatory slide-generation workflow in `SKILL.md`. 3. Each applicable content slide invokes `addEliteHeader`. 4. `addEliteHeader` inserts the hardcoded `Elite PPT Pro` label without checking user preferences. 5. The generated PPTX is delivered with unwanted third-party branding embedded in its slides. ### Impact Assessment The issue affects the integrity and presentation scope of generated deliverables. An attacker does not gain operating-system privileges, a ...[truncated 330 chars]
Remediation: ## Remediation Suggestions 1. Remove the hardcoded `Elite PPT Pro` text from `addEliteHeader`. 2. Replace it with an explicit, user-controlled parameter that defaults to an empty value: ```javascript function addEliteHeader( slide, pres, titleCN, titleEN = "", theme = themeA, brandLabel = "" ) { // Header construction omitted. if (brandLabel) { slide.addText(brandLabel, { x: 8.5, y: 0.08, w: 1.4, h: 0.35, fontSize: 6, fontFace: "Arial", color: theme.midText, align: "right" }); } } ``` 3. Require affirmative user consent before adding Skill or third-party branding. 4. Clearly disclose any branding behavior in the Skill description and generation workflow. 5. Add a QA check confirming that generated slides contain no unrequested labels, attribution, contact details, watermarks, or promotional material.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The manifest-style description lists trigger words such as "elite PPT," "data-driven presentation," "strategy deck," and "investor deck," which are generic phrases a user might naturally say in many ordinary presentation contexts. The file does not provide narrowing conditions, exclusions, or negative examples to clarify when this skill should activate versus other PPT-related skills.

Natural-Language Policy Violations

Medium

Confidence: 89% confidence
Finding: The file presents the skill title and the substantive operating instructions primarily in Chinese, but it does not indicate that the user can choose another language or opt in to this locale. That creates a natural-language locale constraint that may conflict with organizational language-choice policy.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The documentation states that color values must be 6-character hex strings without transparency and explicitly marks 8-character hex values as unsupported. However, the cover-slide example uses `color: "FFFFFF88"` and even comments that transparent color is allowed on the cover, which directly conflicts with the stated rule and could mislead users into writing incompatible code.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The checklist explicitly requires Chinese font usage and the document itself is written as a mandatory QA standard, which indicates a fixed language/locale requirement. Under the policy, forcing a specific language or locale without offering user choice or documenting a justified regional constraint is a natural-language policy violation.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The manifest describes an 'Elite consulting-style PPT generator' with 38 layouts, forced research thresholds, mandatory citations, accent-color limits, conclusion-as-title rules, and dual outputs. This file instead contains a markdown reference library of slide template code snippets for themes/layouts; it does not implement research gating, citation enforcement, title policy enforcement, or HTML preview generation, and the concretely defined layouts shown are materially fewer than the manifest claim.

Natural-Language Policy Violations

Medium

Confidence: 87% confidence
Finding: The top-level title and the file’s instructional content are presented as a Chinese-only slide reference library, which effectively constrains the skill’s language/locale behavior. There is no nearby statement offering a user language choice or explaining that the skill is intentionally region-specific, so this can violate language/locale policy requirements.

Intent-Code Divergence

Low

Confidence: 82% confidence
Finding: Several inline comments and visual descriptions assert specific diagram semantics such as '用三角形模拟' for mountains/funnels or triangle-based structures, but the actual drawing calls use rectangles and ovals. This is more than mere incompleteness because the comments explicitly describe a different rendered construct than the code produces.

Static analysis

No suspicious patterns detected.