ClawHub
Back to skill

Security audit

Pptx Generator

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent PowerPoint helper that writes local presentation artifacts and uses standard PPTX tools, with no evidence of hidden or unrelated behavior.

Install this if you want an agent to help create, inspect, or edit PowerPoint files. Use a sandbox or review generated JS before running compile steps for confidential or important decks, avoid running global dependency installs in a sensitive environment unless you trust the packages, and be aware that broad triggers may activate the skill for general presentation-related requests.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The workflow explicitly instructs creation of JS files, image directories, output folders, and a final PPTX in the workspace without warning the user that files will be written. In an agent setting, silent workspace modification can overwrite user content, create unexpected artifacts, or normalize unsafe file-writing behavior without consent.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The description embeds a very broad trigger list including common terms like "presentation," "slide," and "deck," which can cause the skill to activate in many ordinary contexts unrelated to the user's intent to manipulate PowerPoint files. In an agent environment, overly broad activation increases the chance of unintended invocation, misrouting user requests, and exposing documents or actions to the wrong skill.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal