Security audit

胡田 OPC导师 PPT设计流程

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent PPT design workflow, but it needs Review because its mandatory QA shell template can be command-injected through a crafted presentation title.

Review before installing if agents will run the QA commands automatically. Use sanitized generated filenames rather than raw presentation titles, quote file paths, avoid Python -c string interpolation, and run generation/validation in a least-privilege workspace. Also note that the skill is Chinese-first and includes optional Japanese vaporwave styling.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: references/qa_checklist.md:26
Finding: Command Injection Through Unsanitized Presentation Title in QA Shell Template
Content: View full analysis
' $FILE)" echo "4. DOCTYPE count: $(grep -c '' $FILE)" echo "5. html tag count: $(grep -c '
Remediation: View remediation
&2 exit 2 fi file=$1 ``` 2. Quote every filename expansion and use `--` where supported to prevent word splitting, wildcard expansion, and option confusion: ```bash test -f "$file" stat --format='%s' -- "$file" grep -c -- '' "$file" grep -c -- '' "$file" grep -c -- '

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The HTML template explicitly sets lang="zh-CN", and the surrounding guidance consistently assumes Chinese text handling and Chinese fonts. There is no indication that users can opt into another language/locale, nor that the skill is limited to a China-specific compliance or regional use case.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The file explicitly requires that all Chinese text be rendered through HTML and constrains the amount of Chinese text in generated prompts. This reads as a fixed language requirement rather than offering a language or locale choice, which can violate language/locale policy when not documented as region-specific or user-selected.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The title and all template instructions are written entirely in Chinese, and the file presents them as the default template reference without any opt-in or alternative language path. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This template explicitly prescribes Japanese decorative text as part of the visual output without checking whether the user wants Japanese-language content or whether it is culturally appropriate. In a PPT-generation workflow, this can cause unintended locale injection, user confusion, or brand/cultural mismatch, especially when slides are expected to remain fully Chinese or aligned to a different audience.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The prompt instructs the model to add random katakana text as decoration, which injects specific linguistic content without user consent or semantic control. Random text can create misleading, nonsensical, or inappropriate output and may violate audience, accessibility, or localization expectations in generated presentations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Requiring Japanese decorative text alongside Chinese titles hard-codes a mixed-language output pattern that may not match the user's language preference, target market, or communication requirements. In a presentation-design skill, this is a real safety/quality issue because the agent may produce culturally or professionally unsuitable content even when the user never requested multilingual styling.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.