Ppt To Video

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:03 AM UTC
• Version: 0.1.0

Overview

The skill has a clear PPT-to-video purpose, but it relies on an unreviewed hard-coded local script and makes persistent environment changes.

Review this carefully before installing. Only use it if you trust the local converter script path, understand that it may install Python packages and use host applications, and are comfortable with a Windows registry change for PowerPoint export quality. Prefer a version that includes the converter script in the package, uses a relative verified path, pins dependencies, and asks before changing system settings.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T07 · Tool Hijacking and Spoofing

Warning

• Location: SKILL.md:121

Finding

Execution of an Unbundled Script from an External Hard-Coded Path

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 121–124
Vulnerability Type: Local tool or script substitution through an uncontrolled execution path
Risk Level: Medium

Vulnerable Code

bash

python "C:\Users\LENOVO\.workbuddy\skills\ppt-to-video\scripts\ppt_to_video.py" \

The instructions describe scripts/ppt_to_video.py as a bundled script, but the audited project contains only SKILL.md; no scripts directory or Python implementation is present. The command instead references a hard-coded location outside the audited project.

Technical Analysis

The executable Python file is not part of the reviewed artifact, so its integrity and behavior cannot be established from this project. An agent following the instructions may execute whichever file exists at the hard-coded location.

This creates a local substitution boundary: a file placed or replaced at that path can impersonate the expected conversion script. The command does not validate the script's origin, cryptographic hash, ownership, permissions, or relationship to the loaded skill.

This best matches T07: Tool Hijacking and Spoofing because an unverified local implementation can replace the legitimate-looking conversion tool and receive all arguments supplied by the agent.

Attack Path

1. An attacker obtains write access to the referenced skill directory or causes the environment to resolve the hard-coded path to attacker-controlled content.
2. The attacker creates or replaces ppt_to_video.py with malicious Python code.
3. A user requests PPT-to-video conversion and supplies PPT and audio files.
4. The agent follows SKILL.md and executes the external Python file.
5. The substituted script runs with the privileges of the agent process and receives the user-supplied file paths.

Impact Assessment

Successful exploitation permits arbitrary Python code execution with the same operating-system privileges as the invok ...[truncated 430 chars]

Remediation

View remediation

Remediation Suggestions

• Include scripts/ppt_to_video.py in the project and subject it to the same code review as SKILL.md.
• Resolve the script from the verified project root rather than using a user-specific absolute path.
• Fail closed if the expected bundled script is absent; do not search for or execute substitutes elsewhere.
• Before execution, verify that the resolved path remains inside the project directory and is a regular file rather than a symbolic link or reparse-point redirection.
• For distributed releases, verify the script against a signed manifest or pinned cryptographic hash.
• Restrict write permissions on installed skill files and execute the converter with only the filesystem permissions required for its declared task.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:74

Finding

Automatic Installation of Unpinned Third-Party Python Packages

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 74–78 and 117
Vulnerability Type: Unpinned and unverified dependency installation
Risk Level: Medium

Vulnerable Code

bash

pip install python-pptx
pip install pillow
pip install pywin32
pip install pdf2image

bash

pip install python-pptx pillow

Technical Analysis

The skill directs the agent to install packages without version constraints, cryptographic hashes, a locked dependency graph, or an explicitly trusted package index. It also states that missing dependencies should be installed automatically.

Consequently, the installed artifacts depend on the current state of the configured Python package index and the local pip configuration at execution time. A compromised package release, compromised index, malicious index override, or dependency-resolution change could introduce code that was not reviewed with the skill.

Python packages may execute code during installation, and imported package code executes later when the conversion workflow starts. Installing into the active environment can also modify dependencies used by unrelated tools.

Attack Path

1. A required package is absent from the environment.
2. The agent follows the automatic installation instruction.
3. pip resolves an unconstrained package version from the active configured index.
4. A compromised package release, dependency, or package-index response supplies malicious code.
5. The code executes during installation or when the package is subsequently imported.
6. The malicious dependency operates with the permissions of the agent process and may affect the shared Python environment.

Impact Assessment

Exploitation may result in arbitrary code execution under the invoking user's privileges. Accessible files, environment variables, user-provided PPT and audio files, and credentials available to that process could be exposed or modified.

...[truncated 287 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every direct and transitive dependency to reviewed versions in a lock file.
• Require cryptographic hashes, such as through pip install --require-hashes.
• Use an explicitly configured and approved package index rather than inheriting arbitrary user or system index settings.
• Install dependencies in an isolated virtual environment or container dedicated to this skill.
• Require explicit user approval before changing the environment; do not install packages automatically.
• Scan and periodically review locked dependencies for known vulnerabilities and unexpected ownership or release changes.
• Separate platform-specific optional dependencies so that packages such as pywin32 are installed only where they are required.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill directs automatic modification of the Windows registry to change PowerPoint export resolution, which alters host system settings outside the immediate file-conversion task. Even if intended to improve output quality, changing registry values without explicit informed consent can have persistent side effects and violates least-privilege expectations for a document-processing skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The workflow instructs changing the registry automatically for export quality without prominently warning the user that persistent system configuration will be modified. Silent environment changes are risky because users may not understand the scope, rollback steps, or compatibility consequences.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

brew install ffmpeg

Linux

sudo apt install ffmpeg # Debian/Ubuntu

text

---

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

A PPT-to-video skill would be expected to process files, but this documentation shows it automates installed desktop applications and shell-level binaries (win32com.client, soffice, ffmpeg). Launching external applications/subprocesses is a materially broader capability than the manifest states and is not explicitly declared there.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill says missing Python packages should be installed automatically, which modifies the user's Python environment without clearly disclosing that behavior or handling environment isolation. This can break existing setups, install into the wrong interpreter, or create supply-chain exposure if done implicitly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.