Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent HTML presentation generator, but users should be aware that generated decks may load third-party web assets and PPTX conversion extracts speaker notes.
Install only if you are comfortable with a deck generator that writes HTML/assets locally, may use web search for brand styling, and may load third-party fonts/scripts when generated decks are opened. For confidential decks, use local vendor assets/offline mode where possible, review extracted speaker notes before sharing, and avoid feeding untrusted Markdown or PPTX content without sanitization.
The skill clearly instructs generating HTML files, building wireframe HTML, and completing a final presentation artifact, which implies file-write capability despite no declared permission. Undeclared write behavior is dangerous because it weakens permission transparency and can let a skill create or overwrite local artifacts without the host or user understanding its effective access.
The manifest describes HTML PPT generation and PPTX conversion, but the skill adds a separate cover-generation mode for social-media assets. This expands the skill's functional scope beyond the declared purpose, increasing the chance of unexpected activation and use in contexts the user did not intend.
The instruction to extract brand colors and typography via search broadens the skill from local presentation generation into external information gathering. This is risky because it introduces network-dependent behavior, possible leakage of user intent or brand-sensitive queries, and actions not disclosed in the manifest.
Brand extraction via search is not necessary to satisfy the stated core purpose of generating an HTML PPT and therefore represents unjustified capability expansion. Unnecessary external lookup increases attack surface, can create privacy issues, and may be abused to exfiltrate topic or customer information through queries.
The template loads Google Fonts from third-party domains at render time, which creates network egress, tracking, and supply-chain dependency in what is supposed to be a local HTML presentation template. If the generated deck is opened in a browser, remote providers can observe requests and compromised or unavailable CDN resources can alter rendering or availability.
Loading the Lucide library from jsDelivr introduces an unnecessary third-party script execution path into generated presentations. Any deck opened by a user will execute remote JavaScript in the page context, creating supply-chain and privacy risk beyond simple document generation.
The animation engine attempts a local import first but then falls back to a remote CDN ESM import at runtime, which means generated output may execute untrusted third-party code whenever the local asset is missing or fails. Because this is executable JavaScript rather than passive content, the supply-chain risk and unpredictability are higher than with fonts or stylesheets.
The template includes remote CDN dependencies in generated presentations, which adds outbound network capability and executes third-party JavaScript in the viewer’s browser. Even with SRI on some assets, this expands the trust boundary and can enable tracking, dependency compromise risk, or policy violations in environments that expect self-contained local output.
The runtime loader attempts multiple remote script mirrors for ECharts, Mermaid, Marked, and Highlight.js, causing generated files to fetch and execute code from several external origins. This materially increases supply-chain exposure and creates active network behavior in files that may be opened in sensitive or offline-trusted contexts.
Markdown is converted and assigned directly to innerHTML, so any raw HTML present in slide content can become active DOM content, including script-adjacent payloads, event handlers, or malicious links depending on browser behavior and surrounding markup. In a presentation generator that may ingest user-provided or converted document content, this creates a straightforward content injection/XSS pathway.
The script extracts speaker notes from every slide even though the skill description and module docstring only describe slides, text, and images. Notes often contain hidden/internal guidance, presenter-only remarks, credentials, or sensitive business context that users may not expect to be included in a conversion pipeline, creating a data over-collection and unintended disclosure risk.
The script makes outbound HTTPS requests to third-party CDNs during a local repository audit, which introduces network side effects and trust dependencies unrelated to the skill's core purpose of generating HTML presentations. In an agent skill context, unexpected external fetches can leak execution metadata, break offline/reproducible operation, and expand the attack surface if the script is run automatically in CI or by users who do not expect network access.
This file implements a repository security scanner and exits the process based on audit results, which is materially outside the stated function of an HTML PPT generation skill. Capability drift like this is risky in agent ecosystems because users may invoke or install a presentation skill without expecting file-system-wide scanning, network access, or build-gating behavior, creating unnecessary privileges and surprise side effects.
The success message states the project is '100% SECURE & VERIFIED' even though the script only checks for a few banned domains, some version pinning patterns, and specific SRI hashes. Overstated security claims can mislead maintainers or downstream automation into trusting the package too broadly, reducing scrutiny and increasing the chance that real issues are missed.
The skill manifest and metadata position this skill for HTML PPT generation and PPTX conversion, but the quick-reference expands behavior to social-media cover generation. That scope expansion can cause unintended activation for adjacent requests and make the agent perform actions the user or platform did not expect from this skill.
The brand-asset protocol instructs the agent to extract brand colors and typography via search or local files, introducing an external lookup capability not declared in the manifest. This broadens the skill's data access and tool expectations, increasing the risk of unexpected network access, privacy issues, or retrieval of untrusted content during a presentation-generation task.
The brand reconnaissance step directs the agent to perform web/search-based collection of company colors and typography, which is ancillary to core HTML PPT generation. That creates an unnecessary data-ingestion path from external sources, raising risks of prompt injection from searched content, privacy leakage, and over-collection beyond the user's actual request.
The design file instructs the generated deck to load fonts from Google Fonts and jsDelivr, creating a network dependency in output that is supposed to function as local HTML PPT content. This can leak viewer metadata such as IP address, user agent, and timing to third parties, and it weakens supply-chain and privacy guarantees if external assets change or become unavailable.
The template pulls multiple JavaScript, CSS, and font assets from third-party CDNs at presentation runtime, which gives a nominally local HTML deck implicit network capability and creates a supply-chain trust dependency on external providers. Even with SRI on some assets, the page still leaks client metadata to those domains and can fail or behave unexpectedly if external resources are unavailable, changed, or blocked.
The font fallback runtime does more than passively load a stylesheet once: it actively retries remote fetches on a timed ladder and on network reconnection events. That increases outbound network activity, expands tracking/surveillance surface, and is inconsistent with a presentation template that users may reasonably expect to work offline or without repeated external calls.
The template pulls fonts from Google Fonts at render time, creating external network dependencies that can leak viewer metadata such as IP address, user agent, and timing information and can also break offline or controlled-environment use. In a presentation-generation skill, these remote fetches are not strictly necessary because the same assets can be bundled locally or replaced with system fonts.
The runtime loads Lucide from a third-party CDN, which introduces supply-chain and privacy risk at document open time. If the CDN asset is changed, blocked, or intercepted, the presentation behavior can be altered or user metadata exposed, and the nearby comments about vetted local assets make the trust boundary especially misleading.
The README advertises automatic extraction of speaker notes from PPTX files, but speaker notes often contain non-public talking points, internal commentary, credentials, or other sensitive data not intended for broad redistribution. In a skill meant to transform presentations into HTML output, failing to explicitly warn users and require confirmation increases the risk of accidental exposure of confidential content.
The trigger phrases are broad enough to match ordinary requests like 'make a PPT' or 'slides,' which can cause the skill to activate in situations where the user did not specifically request this implementation path. Over-broad activation is dangerous because it can route unrelated requests into a file-generating workflow with richer capabilities than necessary.
The fallback trigger for vague 'help' requests is ambiguous and can capture generic assistance queries unrelated to presentation generation. This increases the chance of unintended invocation and could expose broader skill behaviors, including file creation and optional external lookup, in contexts where they are not warranted.
Detected: suspicious.dangerous_exec
