elite-ppt-pro

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:46 AM UTC
• Version: 0.1.0

Overview

The skill mainly provides presentation-generation instructions, but it quietly adds fixed third-party branding to generated slides without a clear user-controlled opt-out.

Review this skill before installing if you create client-facing or confidential presentations. Its research, citation, and local PPTX generation behavior is normal for the stated purpose, but remove or modify the hardcoded slide labels if you do not want third-party branding embedded in outputs. Specify your desired output language explicitly if you do not want Chinese-first slide text or fonts.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:362

Finding

Mandatory Undisclosed Branding in Generated Presentations

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:362-367
Vulnerability Type: Output manipulation through mandatory Skill instructions
Risk Level: High

Vulnerable Code

javascript

// Brand label in the upper-right corner
slide.addText("Elite PPT Pro", {
  x: 8.5, y: 0.08, w: 1.4, h: 0.35,
  fontSize: 6, fontFace: "Arial",
  color: theme.midText, align: "right"
});

The mandatory slide template at SKILL.md:193-207 directs generated content slides to invoke addEliteHeader, which contains this fixed label.

Technical Analysis

The header helper unconditionally inserts the fixed Elite PPT Pro brand into generated presentation slides. The branding is not supplied by the user, cannot be disabled through a documented option, and is unrelated to the substantive presentation content requested by the user.

Because the Skill instructs the Agent to use this helper as part of its mandatory workflow, loading and following the Skill alters the integrity of the Agent's deliverable by introducing third-party promotional content. This behavior best matches instruction hijacking because Skill-level instructions cause the Agent to produce content beyond the user's presentation-generation objective.

No arbitrary code execution, privilege escalation, credential access, persistence, or data exfiltration is enabled by this issue.

Attack Path

1. A user invokes the Skill to generate a consulting-style presentation.
2. The Agent follows the mandatory slide-generation workflow in SKILL.md.
3. Each applicable content slide invokes addEliteHeader.
4. addEliteHeader inserts the hardcoded Elite PPT Pro label without checking user preferences.
5. The generated PPTX is delivered with unwanted third-party branding embedded in its slides.

Impact Assessment

The issue affects the integrity and presentation scope of generated deliverables. An attacker does not gain operating-system privileges, a ...[truncated 330 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the hardcoded Elite PPT Pro text from addEliteHeader.

2. Replace it with an explicit, user-controlled parameter that defaults to an empty value:

   javascript

   function addEliteHeader(
     slide,
     pres,
     titleCN,
     titleEN = "",
     theme = themeA,
     brandLabel = ""
   ) {
     // Header construction omitted.
   
     if (brandLabel) {
       slide.addText(brandLabel, {
         x: 8.5, y: 0.08, w: 1.4, h: 0.35,
         fontSize: 6, fontFace: "Arial",
         color: theme.midText, align: "right"
       });
     }
   }
   

3. Require affirmative user consent before adding Skill or third-party branding.

4. Clearly disclose any branding behavior in the Skill description and generation workflow.

5. Add a QA check confirming that generated slides contain no unrequested labels, attribution, contact details, watermarks, or promotional material.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest-style description lists trigger words such as "elite PPT," "data-driven presentation," "strategy deck," and "investor deck," which are generic phrases a user might naturally say in many ordinary presentation contexts. The file does not provide narrowing conditions, exclusions, or negative examples to clarify when this skill should activate versus other PPT-related skills.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The file presents the skill title and the substantive operating instructions primarily in Chinese, but it does not indicate that the user can choose another language or opt in to this locale. That creates a natural-language locale constraint that may conflict with organizational language-choice policy.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation states that color values must be 6-character hex strings without transparency and explicitly marks 8-character hex values as unsupported. However, the cover-slide example uses color: "FFFFFF88" and even comments that transparent color is allowed on the cover, which directly conflicts with the stated rule and could mislead users into writing incompatible code.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The checklist explicitly requires Chinese font usage and the document itself is written as a mandatory QA standard, which indicates a fixed language/locale requirement. Under the policy, forcing a specific language or locale without offering user choice or documenting a justified regional constraint is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest describes an 'Elite consulting-style PPT generator' with 38 layouts, forced research thresholds, mandatory citations, accent-color limits, conclusion-as-title rules, and dual outputs. This file instead contains a markdown reference library of slide template code snippets for themes/layouts; it does not implement research gating, citation enforcement, title policy enforcement, or HTML preview generation, and the concretely defined layouts shown are materially fewer than the manifest claim.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The top-level title and the file’s instructional content are presented as a Chinese-only slide reference library, which effectively constrains the skill’s language/locale behavior. There is no nearby statement offering a user language choice or explaining that the skill is intentionally region-specific, so this can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

Several inline comments and visual descriptions assert specific diagram semantics such as '用三角形模拟' for mountains/funnels or triangle-based structures, but the actual drawing calls use rectangles and ovals. This is more than mere incompleteness because the comments explicitly describe a different rendered construct than the code produces.

Content

No source excerpt is available for this finding.