Security audit

generate-html-ppt

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent HTML presentation generator, but users should be aware that generated decks may load third-party web assets and PPTX conversion extracts speaker notes.

Install only if you are comfortable with a deck generator that writes HTML/assets locally, may use web search for brand styling, and may load third-party fonts/scripts when generated decks are opened. For confidential decks, use local vendor assets/offline mode where possible, review extracted speaker notes before sharing, and avoid feeding untrusted Markdown or PPTX content without sanitization.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (31)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill clearly instructs generating HTML files, building wireframe HTML, and completing a final presentation artifact, which implies file-write capability despite no declared permission. Undeclared write behavior is dangerous because it weakens permission transparency and can let a skill create or overwrite local artifacts without the host or user understanding its effective access.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The manifest describes HTML PPT generation and PPTX conversion, but the skill adds a separate cover-generation mode for social-media assets. This expands the skill's functional scope beyond the declared purpose, increasing the chance of unexpected activation and use in contexts the user did not intend.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The instruction to extract brand colors and typography via search broadens the skill from local presentation generation into external information gathering. This is risky because it introduces network-dependent behavior, possible leakage of user intent or brand-sensitive queries, and actions not disclosed in the manifest.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: Brand extraction via search is not necessary to satisfy the stated core purpose of generating an HTML PPT and therefore represents unjustified capability expansion. Unnecessary external lookup increases attack surface, can create privacy issues, and may be abused to exfiltrate topic or customer information through queries.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The template loads Google Fonts from third-party domains at render time, which creates network egress, tracking, and supply-chain dependency in what is supposed to be a local HTML presentation template. If the generated deck is opened in a browser, remote providers can observe requests and compromised or unavailable CDN resources can alter rendering or availability.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: Loading the Lucide library from jsDelivr introduces an unnecessary third-party script execution path into generated presentations. Any deck opened by a user will execute remote JavaScript in the page context, creating supply-chain and privacy risk beyond simple document generation.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The animation engine attempts a local import first but then falls back to a remote CDN ESM import at runtime, which means generated output may execute untrusted third-party code whenever the local asset is missing or fails. Because this is executable JavaScript rather than passive content, the supply-chain risk and unpredictability are higher than with fonts or stylesheets.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: The template includes remote CDN dependencies in generated presentations, which adds outbound network capability and executes third-party JavaScript in the viewer’s browser. Even with SRI on some assets, this expands the trust boundary and can enable tracking, dependency compromise risk, or policy violations in environments that expect self-contained local output.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The runtime loader attempts multiple remote script mirrors for ECharts, Mermaid, Marked, and Highlight.js, causing generated files to fetch and execute code from several external origins. This materially increases supply-chain exposure and creates active network behavior in files that may be opened in sensitive or offline-trusted contexts.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: Markdown is converted and assigned directly to innerHTML, so any raw HTML present in slide content can become active DOM content, including script-adjacent payloads, event handlers, or malicious links depending on browser behavior and surrounding markup. In a presentation generator that may ingest user-provided or converted document content, this creates a straightforward content injection/XSS pathway.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The script extracts speaker notes from every slide even though the skill description and module docstring only describe slides, text, and images. Notes often contain hidden/internal guidance, presenter-only remarks, credentials, or sensitive business context that users may not expect to be included in a conversion pipeline, creating a data over-collection and unintended disclosure risk.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The script makes outbound HTTPS requests to third-party CDNs during a local repository audit, which introduces network side effects and trust dependencies unrelated to the skill's core purpose of generating HTML presentations. In an agent skill context, unexpected external fetches can leak execution metadata, break offline/reproducible operation, and expand the attack surface if the script is run automatically in CI or by users who do not expect network access.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: This file implements a repository security scanner and exits the process based on audit results, which is materially outside the stated function of an HTML PPT generation skill. Capability drift like this is risky in agent ecosystems because users may invoke or install a presentation skill without expecting file-system-wide scanning, network access, or build-gating behavior, creating unnecessary privileges and surprise side effects.

Intent-Code Divergence

Low

Confidence: 84% confidence
Finding: The success message states the project is '100% SECURE & VERIFIED' even though the script only checks for a few banned domains, some version pinning patterns, and specific SRI hashes. Overstated security claims can mislead maintainers or downstream automation into trusting the package too broadly, reducing scrutiny and increasing the chance that real issues are missed.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The skill manifest and metadata position this skill for HTML PPT generation and PPTX conversion, but the quick-reference expands behavior to social-media cover generation. That scope expansion can cause unintended activation for adjacent requests and make the agent perform actions the user or platform did not expect from this skill.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The brand-asset protocol instructs the agent to extract brand colors and typography via search or local files, introducing an external lookup capability not declared in the manifest. This broadens the skill's data access and tool expectations, increasing the risk of unexpected network access, privacy issues, or retrieval of untrusted content during a presentation-generation task.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The brand reconnaissance step directs the agent to perform web/search-based collection of company colors and typography, which is ancillary to core HTML PPT generation. That creates an unnecessary data-ingestion path from external sources, raising risks of prompt injection from searched content, privacy leakage, and over-collection beyond the user's actual request.

Context-Inappropriate Capability

Low

Confidence: 91% confidence
Finding: The design file instructs the generated deck to load fonts from Google Fonts and jsDelivr, creating a network dependency in output that is supposed to function as local HTML PPT content. This can leak viewer metadata such as IP address, user agent, and timing to third parties, and it weakens supply-chain and privacy guarantees if external assets change or become unavailable.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The template pulls multiple JavaScript, CSS, and font assets from third-party CDNs at presentation runtime, which gives a nominally local HTML deck implicit network capability and creates a supply-chain trust dependency on external providers. Even with SRI on some assets, the page still leaks client metadata to those domains and can fail or behave unexpectedly if external resources are unavailable, changed, or blocked.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The font fallback runtime does more than passively load a stylesheet once: it actively retries remote fetches on a timed ladder and on network reconnection events. That increases outbound network activity, expands tracking/surveillance surface, and is inconsistent with a presentation template that users may reasonably expect to work offline or without repeated external calls.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The template pulls fonts from Google Fonts at render time, creating external network dependencies that can leak viewer metadata such as IP address, user agent, and timing information and can also break offline or controlled-environment use. In a presentation-generation skill, these remote fetches are not strictly necessary because the same assets can be bundled locally or replaced with system fonts.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The runtime loads Lucide from a third-party CDN, which introduces supply-chain and privacy risk at document open time. If the CDN asset is changed, blocked, or intercepted, the presentation behavior can be altered or user metadata exposed, and the nearby comments about vetted local assets make the trust boundary especially misleading.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The README advertises automatic extraction of speaker notes from PPTX files, but speaker notes often contain non-public talking points, internal commentary, credentials, or other sensitive data not intended for broad redistribution. In a skill meant to transform presentations into HTML output, failing to explicitly warn users and require confirmation increases the risk of accidental exposure of confidential content.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The trigger phrases are broad enough to match ordinary requests like 'make a PPT' or 'slides,' which can cause the skill to activate in situations where the user did not specifically request this implementation path. Over-broad activation is dangerous because it can route unrelated requests into a file-generating workflow with richer capabilities than necessary.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: The fallback trigger for vague 'help' requests is ambiguous and can capture generic assistance queries unrelated to presentation generation. This increases the chance of unintended invocation and could expose broader skill behaviors, including file creation and optional external lookup, in contexts where they are not warranted.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/generate-previews.mjs:669

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/generate-previews.mjs:669

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: 未命名文件夹/scripts/generate-previews.mjs:669