Security audit

image-ppt

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent PPT-generation workflow, but it understates privacy and network exposure while processing user documents through cloud or external image-generation tools.

Review before installing, especially if you may use confidential PDFs, unpublished research, student data, business reports, or proprietary templates. Use only non-sensitive or redacted materials unless you are comfortable sending document content or derived prompts to the AI/image provider being used, and invoke the skill explicitly rather than relying on broad PPT trigger phrases.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The README states the skill does not go online or upload data, but the documented flow explicitly depends on cloning from GitHub and using external image-generation services. This can mislead users about data exposure and trust boundaries, causing them to provide sensitive documents under a false assumption of local-only processing.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The README states that the skill 'will not network or upload data,' but the same document instructs users to clone from GitHub and recommends external image-generation tooling. This creates a misleading security representation: users may believe sensitive documents remain fully local when the workflow may require network access or transmission to third-party services, increasing the risk of unintended data disclosure.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The phrase "make a PPT" is so broad that it can accidentally trigger this skill during ordinary conversations unrelated to the user's intent to run an installable workflow. Overly generic triggers increase the chance of unintended activation, causing the agent to read files, orchestrate tools, or invoke external services without sufficiently explicit user consent.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: Several trigger phrases in the list are generic requests a user might naturally make in many contexts, which raises the risk of this skill intercepting common workflows unexpectedly. In an agent environment with tool and file access, ambiguous activation can lead to unintended processing of local documents and use of external generation services.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The trigger phrases include broad, natural language requests such as '做一份 PPT' or '把这份 PDF 做成课堂汇报 PPT,' which are common user utterances and could cause the skill to auto-activate unexpectedly. In agent environments with automatic skill discovery, overly generic triggers can result in unintended execution, accidental file processing, or invocation in contexts where the user did not intend to use this workflow.

Missing User Warnings

Low

Confidence: 79% confidence
Finding: The README tells the agent to clone a repository into local skill directories and create those directories if absent, but does not prominently warn that this changes the local filesystem. In agentic environments, installation instructions that perform writes without clear disclosure can lead to unexpected persistence, user confusion, or unsafe trust in remote code/content fetched from the network.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill explicitly instructs users to upload source documents and optional reference images, and to use external image-generation tools across multiple platforms, but it does not warn that those inputs may be transmitted to third-party services for processing. This creates a real privacy and confidentiality risk, especially when the source material contains unpublished research, internal reports, student data, or other sensitive content.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: The workflow generates multiple derivative artifacts, including preview images, per-slide images, and final PPTX outputs, but does not warn users that these files may persist, duplicate source content, or overwrite existing files in the working environment. While this is less severe than external data disclosure, it can still lead to unintended retention of sensitive content and accidental file-handling mistakes.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The trigger phrases include very generic requests such as '做PPT' and '生成PPT', which are common user intents and can cause the skill to activate in situations far beyond its specialized workflow. Over-broad activation increases the chance of prompt hijacking at the orchestration layer, unintended file processing, or this skill preempting safer or more appropriate skills.

Vague Triggers

Low

Confidence: 82% confidence
Finding: The manifest mixes highly specific triggers with broad everyday phrases without defining when the skill should or should not activate. In multi-skill environments, this ambiguity can lead to accidental invocation on unrelated presentation requests, creating unsafe routing, incorrect tool use, or unnecessary access to user-provided documents.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.