Marp Slide Show/Deck Generator

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:28 AM UTC
• Version: 1.0.0

Overview

This skill coherently creates Marp slide decks, with the main caution being an unpinned Marp CLI dependency install.

Before installing, be aware that the skill writes source and rendered slide files that may contain your input material. For stronger supply-chain control, use a pinned or preinstalled Marp CLI version instead of allowing runtime installation of the latest package.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/output-formats.md:50

Finding

Unpinned Marp CLI Installation and Runtime Execution

Content

View full analysis

Vulnerability Details

File Locations:

• SKILL.md:5
• references/output-formats.md:50-54
• references/output-formats.md:118

Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

SKILL.md:5:

yaml

metadata: { "openclaw": { "emoji": "📊", "requires": { "bins": ["marp"] }, "install": [{ "id": "node-marp", "kind": "node", "package": "@marp-team/marp-cli", "bins": ["marp"], "label": "Install Marp CLI (node)" }] } }

references/output-formats.md:50-54:

markdown

Optional editable mode:

```bash
npx --yes @marp-team/marp-cli input.slides.md --pptx --pptx-editable -o output.slides.pptx

text

`references/output-formats.md:118`:

```markdown
- If `marp` is unavailable, install `@marp-team/marp-cli` before rendering.

Technical Analysis

The Skill instructs the Agent to install or execute @marp-team/marp-cli without specifying an exact reviewed version or verifying a package integrity hash. The npx --yes command can automatically download and execute the package selected by the package registry without requesting confirmation.

Consequently, the effective executable dependency may change after the Skill has been audited. If the package registry account, distribution channel, or a future package release is compromised, the Agent could retrieve and execute attacker-controlled package code. Installation lifecycle scripts and the CLI itself execute with the permissions of the account running the Agent.

The package name is consistent with the Skill's declared Marp functionality, and the reviewed files contain no evidence that its current release is malicious. The vulnerability is the unsafe, mutable dependency acquisition process rather than a confirmed malicious payload.

Attack Path

1. An attacker compromises the package publisher, registry account, distribution infrastructure, or a future release of @marp-team/marp-cli.
2. The attacker publishes a modified package containing malicious ...[truncated 1122 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to an exact, reviewed version in both metadata and commands:

   yaml

   "package": "@marp-team/marp-cli@<reviewed-exact-version>"
   

   bash

   npx --yes @marp-team/marp-cli@<reviewed-exact-version> input.slides.md --pptx --pptx-editable -o output.slides.pptx
   

2. Declare the dependency in a project manifest and commit a lockfile containing registry resolution and integrity data. Use reproducible, lockfile-enforcing installation commands such as npm ci.

3. Configure the package manager to use an approved registry and validate package provenance and integrity before execution.

4. Avoid runtime package fetching where possible. Preinstall the reviewed CLI in a controlled build image and invoke the locally installed binary.

5. Do not automatically install a missing executable without explicit authorization. Fail safely with a clear dependency error when the approved version is unavailable.

6. Run rendering in a sandbox with least privilege, restricted network access, no unnecessary credentials, and write access limited to the intended input and output directories.

7. Review dependency updates before changing the pinned version, including package provenance, release changes, transitive dependencies, and lockfile integrity.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md

9. Render the deck into the requested format with the installed `marp` CLI.
10. Verify the rendered deck in its target aspect ratio and confirm that no slide content is cropped or vertically cut off.

## Output Rules

- Accept any source material that can be turned into a coherent presentation.
- Supported rendered outputs are `.html` (default), `.pdf`, `.pptx`, notes text, single-slide `.png` / `.jpeg`, and multi-slide image export.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The document instructs users to run npx --yes @marp-team/marp-cli without pinning a specific version. That causes the latest package version to be fetched at execution time, creating a supply-chain risk: a compromised upstream release or unexpected breaking change could execute unreviewed code in the user's environment. In this skill context, the risk is more credible because the file is operational guidance that may be copied directly into a shell by users or an agent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill explicitly defaults to generating rendered artifacts and keeping a source deck, but it does not warn that it will write files to the workspace by default. This can surprise users, especially when source material may be sensitive, because it creates additional persistent copies such as .html and .slides.md outputs.

Content

No source excerpt is available for this finding.