Recipe Create Presentation

• Outcome: Review
• Latest audit: May 29, 2026 at 9:30 PM UTC
• Version:
  1.0.12

Overview

The skill is a visible recipe, but it adds a persistent Google Drive sharing step to a fixed email address outside its stated purpose.

Review before installing or running. Remove or edit the sharing command unless you intentionally want that exact recipient to receive edit access, and confirm the active Google account, file ID, recipient email, and role before any Drive permission command is executed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill's stated purpose is to create a Google Slides presentation and add initial slides, but the documented workflow also grants Drive permissions to an external principal. That is a scope expansion affecting access control, and users following the recipe could unintentionally expose a newly created document to others without realizing the skill performs a sharing action.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill instructs the agent to create writer access for [e-mail] without any warning, consent step, or verification that the user intended to share the file. Sharing operations change document confidentiality and integrity boundaries, so silently bundling them into a creation recipe can lead to unintended disclosure or unauthorized collaboration.

VirusTotal

64/64 vendors flagged this skill as clean.