GoAI PPT Gen

• Outcome: Review
• Latest audit: May 28, 2026 · 8:22 AM UTC
• Version: 1.0.1

Overview

This PPT generator mostly matches its stated purpose, but it needs review because it sends user content and local references to GoAI, uses an API key, auto-opens generated files, and has a misleading insufficient-credit fallback.

Install only if you trust GoAI with your prompt, reference images, generated deck links, and API-key-backed account usage. Do not pass confidential files unless you intend to upload them to the provider. Treat the insufficient-credit demo URL as a generic sample, not your generated presentation, and be aware the script may auto-open the downloaded PPTX locally.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (5)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

elif system == "Linux":
            subprocess.run(["xdg-open", path], check=True, capture_output=True)
        elif system == "Windows":
            subprocess.run(["start", "", path], check=True, shell=True, capture_output=True)
    except subprocess.CalledProcessError:
        pass

• Confidence: 97% confidence
• Finding: On Windows, the code invokes 'start' with shell=True while passing a variable path. Because shell=True causes command-line interpretation by the shell, a crafted filename or path containing shell metacharacters could trigger unintended command execution instead of merely opening the PPT file.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill clearly exercises sensitive capabilities including environment access, shell execution, filesystem reads/writes, and outbound network access, yet it declares no explicit permissions boundary. That mismatch can prevent users or the hosting platform from making an informed trust decision and increases the chance of over-privileged execution for a networked, file-uploading skill.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The skill states that local reference images are uploaded and user request content is sent to a third-party service, but it does not present this as a clear user-facing privacy/data-transfer warning. This is dangerous because users may unknowingly provide sensitive local files, proprietary content, or confidential business material to a remote service.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The manifest’s default prompt is highly permissive and directs the agent to forward the user's PPT request "as-is" to an external script/API without meaningful trigger constraints, content boundaries, or exclusions. This broad invocation pattern increases the chance the skill is activated for unsafe or unintended requests, including sensitive data forwarding or generation of inappropriate content, especially because it also instructs the agent to persist until success and disclose resulting artifact locations/URLs.

Session Persistence

Medium

• Category: Rogue Agent

Content

This package targets the production PPT service at `https://ppt.mustgoai.com`. Override `GOAI_BASE_URL` only when you intentionally need a different endpoint.

This skill now uses a single cross-platform Python entrypoint through `uv`. Treat `uv` as the only runtime dependency the user needs to install manually. On first run, `uv` may create a local environment, install `httpx`, and download Python if the machine does not already have a usable interpreter. That first-run setup is expected and should not be described as an error.

If the user provides local reference images, the script uploads them first and sends the resulting URLs as `referenceImages`. If the user provides remote URLs, the script passes them through unchanged.

• Confidence: 74% confidence
• Finding: The skill explicitly allows uv to create a local environment, install dependencies, and even download Python on first run, which introduces persistent system changes and additional supply-chain exposure. In a skill that also performs network operations and handles local files, this persistence expands the trust boundary and can surprise users who expected a transient action.

Static analysis

No suspicious patterns detected.