Security audit

octo PPT

Security checks for vulnerabilities and agentic risk

Overview

This is a real presentation-generation skill, but its preview server can expose generated decks to the local network without authentication and keep running after generation.

Review carefully before installing. Use it only for decks you are comfortable previewing on your machine, set DASHI_PPT_PREVIEW_HOST=127.0.0.1 before rendering, stop preview server processes after use, and avoid confidential content unless the LAN exposure is fixed. Expect npm/Playwright downloads, a remote update check, local browser editing state, and creator social links in the preview UI.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:23
Finding: Mandatory Agent Response Modification and Unsolicited Creator Promotion
Content: View full analysis
/scripts/check_latest_version.mjs If the script produces output, append that output to the end of the final response to remind the user to update. If it produces no output or the check fails, remain silent and do not mention the version check. ``` The generated presentation template also embeds creator-controlled promotional links: ```html ``` The invoked script performs remote requests to creator-selected endpoints: ```js const REMOTE_VERSION_ENDPOINTS = [ { url: 'https://registry.npmmirror.com/dashi-ppt-skill/latest', pick: (json) => json.version }, { url: 'https://registry.npmjs.org/dashi-ppt-skill/latest', pick: (json) => json.version }, { url: 'https://raw.githubusercontent.com/chuspeeism/dashi-ppt-skill/main/skills/dashi-ppt/project/package.json', pick: (json) => json.version }, ]; ` ...[truncated 2286 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: project/scripts/start-preview-server.mjs:21
Finding: Unauthenticated LAN Exposure of Confidential Presentation Content
Content: View full analysis
{ const httpPrimary = `http://${LOCAL_HOSTNAME}.local:${PORT}/`; const httpsPrimary = `https://${LOCAL_HOSTNAME}.local:${PORT}/`; if (!isLoopbackHost(HOST)) { console.warn( `[preview] Warning: bou ...[truncated 2974 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (132)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.
md
当前 `SKILL.md` 所在目录就是 Skill 根目录,下文记为 `<skill-root>`。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.
md
- 运行生成器需要 Node.js 20+ 和 npm;首次生成时渲染脚本会在 Skill 内置 `project/` 目录安装依赖。Windows 用 `render_goal_deck.ps1`(直接 PowerShell,不经 WSL/bash);macOS / Linux 用 `render_goal_deck

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.
md
依赖。Windows 用 `render_goal_deck.ps1`(直接 PowerShell,不经 WSL/bash);macOS / Linux 用 `render_goal_deck.sh`。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 193)May include surrounding context.
md
`role` 只用于草稿选页,最终 JSON 必须落成具体 `layout`。角色说明见 `references/layout-roles.md`;真实候选以 `layout:query` 输出为准。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 209)May include surrounding context.
md
普通生成不要读 `layout-manifest.json`。先用 `layout:query` 输出的候选摘要。只有需要更细契约时,再用 `npm --prefix <skill-root>/project run inspect:layout -- --compact <layout...>` 看页面契约:

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · project/assets/template-swiss.html (reported line 8)May include surrounding context.
html
<meta name="viewport" content="width=device-width, initial-scale=1.0"> <link rel="icon" type="image/png" href="assets/skill/dashi-ppt-favicon.png"> <title>[必填] 替换为 PPT 标题 · Deck Title</title>   <style> @font-face{

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Within the vendor library, model rendering support loads JavaScript at runtime via dynamic import from jsDelivr or a configured module URL. For a skill whose stated purpose is making PPT/HTML presentations, downloading and executing remote code is not an obvious or necessary capability and materially expands the trust boundary.
Content: No source excerpt is available for this finding.

Context Leakage

High

Category: Data Exfiltration
Confidence: 75% confidence
Finding: Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.
Content: Scanner excerpt · project/dist/theme-runtime/imported-theme-runtime.theme03.js (reported line 199)May include surrounding context.
js
/* ---- entrance animation -------------------------------------------------- Base state is the *visible* end-state so content always renders (print, reduced-motion, and non-painting capture contexts included). The motion is added only as a transform-based enhancement that never hides content. */ @media (prefers-reduced-motion: no-preference) { [data-deck-active] .rd-anim { animation: rd-rise 0.55s cubic-bezier(.2,.7,.2,1) both; }

Context Leakage

High

Category: Data Exfiltration
Confidence: 75% confidence
Finding: Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.
Content: Scanner excerpt · project/src/components/themes/theme03/source/src/theme.css (reported line 179)May include surrounding context.
css
/* ---- entrance animation -------------------------------------------------- Base state is the *visible* end-state so content always renders (print, reduced-motion, and non-painting capture contexts included). The motion is added only as a transform-based enhancement that never hides content. */ @media (prefers-reduced-motion: no-preference) { [data-deck-active] .rd-anim { animation: rd-rise 0.55s cubic-bezier(.2,.7,.2,1) both; }

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest description is entirely in Chinese, which imposes a specific language on users reading the skill metadata without offering a language choice or noting that the skill is region/language-specific. The policy only permits fixed language constraints when the skill clearly offers opt-in or is explicitly justified as region-specific.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The function Xt performs fetch(e, ...) on image URLs derived from slide content, which can transmit the user's browser request and related system/network metadata to remote origins. In this file, there is no confirmation prompt, visible logging, or comment/docstring warning users that export may contact external hosts to retrieve images.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The st function applies snapshot edits by assigning innerHTML to elements with data-editable-id, changes slide order/state, hides canvases, and appends generated <img> elements. These are direct page/DOM modifications, but this code contains no confirmation, print/log message, or comment explaining to users that running the export workflow mutates the current document state.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest describes a PPT-generation skill that produces offline-openable HTML presentations and exports PPTX/PDF, which implies local document generation behavior. This bundled Unicorn Studio runtime performs network fetches for scene definitions and assets, including remote JSON/project data, images, videos, and dynamically imported renderer modules from external CDNs, which is broader than the stated offline-generation behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: This JavaScript bundle performs remote fetches and loads remote modules/assets, including fetch(...) for project data and dynamic import(t) from a CDN URL, as well as remote image/video/model asset loading. In this file there is no confirmation prompt, logging, comment, or docstring warning users that the skill may contact external services and transmit request metadata such as IP address, user agent, and requested project/resource identifiers.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This JavaScript bundle contains extensive user-facing labels, captions, and prompts hard-coded in Chinese, while only a narrow special case checks window.__deckI18n?.isEn for a couple of upload strings. That creates a locale-policy risk because the skill behavior is largely fixed to a specific language rather than consistently offering a user language choice or documenting a justified locale constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The runtime embeds extensive Chinese-language UI strings, labels, captions, and defaults throughout the skill, with only a very limited English check in one upload placeholder path. This effectively enforces a specific language/locale for most rendered output without offering a general user choice or documenting a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This JavaScript bundle contains extensive user-facing strings in Chinese across labels, controls, captions, warnings, and UI text, effectively forcing a specific language for the skill experience. There is no visible opt-in, locale selector, or documented region-specific justification in this file, so it violates the language/locale policy requirement.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The SCOPING CONTRACT comment states that nothing leaks to a host app's globals and that navigation chrome is separate, yet the runtime later injects styles into document.head, toggles body classes, creates a fixed button on document.body, and publishes several window globals. This is an active contradiction between the documented isolation intent and actual host-wide behavior.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest describes a PPT-generation skill, but this runtime also installs global functions that can render, rerender, and release arbitrary runtime slides across the host page via window.__renderRuntimeSlide, __renderRuntimeSlides, __releaseRuntimeSlide, and __releaseInactiveRuntimeSlides. That is a host-page orchestration capability beyond merely defining a presentation theme.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The manifest describes a skill for generating HTML presentations and exporting PPTX/PDF, but this runtime also provides an in-browser media asset editor: drag-and-drop uploads, cropping/reframing controls, local persistence via localStorage, and file writes through window.omelette.writeFile. Those are broader interactive content-management behaviors rather than just expected static theme rendering for PPT generation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Inside the image-slot custom element runtime, dropped media is serialized and persisted using localStorage and, when available, window.omelette.writeFile to .image-slots.state.json. For a PPT-generation skill, persistent browser-side state storage and host file writes for editor state are not obviously required unless explicitly declared as part of the skill's editable-media feature set.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The image-slot runtime persists user-dropped media to .image-slots.state.json via window.omelette.writeFile(...) and falls back to localStorage.setItem(...), but this bundled code does not provide a clear user-facing warning that uploaded media will be stored persistently. The UI exposes upload/replace/remove actions, yet the persistence behavior itself is implicit and only inferable from code.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This bundled JavaScript contains extensive hard-coded Chinese UI strings and labels throughout the runtime, indicating the skill effectively forces a specific language/locale in its natural-language output. There is no visible user opt-in, language selector, or documented region-specific justification in this file, which can violate locale-choice policy.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.insecure_tls_verification

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: project/scripts/chrome-path.mjs:19

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: project/scripts/export-pptx.mjs:71

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: project/scripts/openssl-path.mjs:15

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: project/scripts/preview-freshness.mjs:48

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: project/scripts/preview/tls.mjs:18

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: project/scripts/stage-media.mjs:297

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: project/scripts/start-preview-server.mjs:63

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: project/scripts/start-preview-server.mjs:465