ClawHub
Back to skill

Security audit

AiPPT-skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real AiPPT integration, but its local credential handling and broad activation scope need review before installation.

Install only if you are comfortable sending presentation topics, URLs, and selected local documents to AiPPT.cn. Prefer platform-managed secrets over a local .env file, avoid installing in shared writable directories, and clear or protect the token cache if you use the skill.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/aippt.sh:11
Finding

Arbitrary Shell Execution Through Executable .env Configuration

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/aippt.sh:83
Finding

Reusable Authentication Token Stored in an Unprotected Plaintext Cache

Content
View full analysis
/dev/null && { echo "$t"; return 0; } fi local ts; ts=$(date +%s) local sig; sig=$(generate_signature "GET" "/api/grant/token/" "$ts") local resp; resp=$(curl -sL "${BASE_URL}/api/grant/token/?uid=${UID_VALUE}" \ -H "x-api-key: ${APP_KEY}" -H "x-timestamp: ${ts}" -H "x-signature: ${sig}") local token exp cached_at token=$(echo "$resp" | python3 -c "import sys,json;print(json.load(sys.stdin)['data']['token'])") exp=$(echo "$resp" | python3 - "$ts" <<'PYEOF' import sys, json data = json.load(sys.stdin)['data'] base = int(sys.argv[1]) print(base + int(data.get('time_expire', 259200))) PYEOF ) cached_at=$(date +%s) python3 - "$TOKEN_CACHE" "$token" "$exp" "$cached_at" <<'PYEOF' import sys, json path, token, exp, cached_at = sys.argv[1], sys.argv[2], int(sys.argv[3]), int(sys.argv[4]) json.dump({'token': token, 'expire_time': exp, 'cached_at': cached_at}, open(path, 'w'), indent=2) PYEOF ``` ### Technical Analysis The Skill writes a reusable API bearer token to `.token_cache.json` in plaintext. The write operation does not: - Set a restrictive process umask. - Explicitly create the file with mode `0600`. - Verify that the cache is owned by the current user. - Reject symbolic links. - Use atomic file creation and replacement. - Store the token in a platform-managed credential facility. The ...[truncated 2376 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (15)

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

The skill explicitly supports selecting an external model/provider and enabling web search, which can route user content to third-party processing or external retrieval paths. This increases data exposure and compliance risk if users are not clearly informed which provider is used, what data is sent externally, and whether web search is enabled.

Content

Scanner excerpt · SKILL.md (reported line 197)May include surrounding context.

bash scripts/aippt.sh senior_options_pretty bash scripts/aippt.sh generate "标题" --outline-only bash scripts/aippt.sh generate "标题" --options '{"page":3,"group":6,"scene":18,"tone":40,"language":47}' bash scripts/aippt.sh generate "标题" --model "deepSeek-v3" --web-search --options '{"page":3,"group":6,"scene":18,"tone":40,"language":47}' bash scripts/aippt.sh generate_continue "<task_id>" ""

text

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/aippt.sh (reported line 11)May include surrounding context.

sh
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
SKILL_DIR="$(dirname "$SCRIPT_DIR")"
ENV_FILE="${SKILL_DIR}/.env"
TOKEN_CACHE="${SKILL_DIR}/.token_cache.json"
BASE_URL="https://co.aippt.cn"

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/aippt.sh (reported line 107)May include surrounding context.

sh
fi
    local ts; ts=$(date +%s)
    local sig; sig=$(generate_signature "GET" "/api/grant/token/" "$ts")
    local resp; resp=$(curl -sL "${BASE_URL}/api/grant/token/?uid=${UID_VALUE}" \
        -H "x-api-key: ${APP_KEY}" -H "x-timestamp: ${ts}" -H "x-signature: ${sig}")
    local token exp cached_at
    token=$(echo "$resp" | python3 -c "import sys,json;print(json.load(sys.stdin)['data']['token'])")

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/aippt.sh (reported line 202)May include surrounding context.

sh
[ -n "$senior_opts" ] && curl_args+=(--data-urlencode "senior_options=${senior_opts}")
            [ -n "$is_web_search" ] && curl_args+=(--data-urlencode "is_web_search=${is_web_search}")
            [ -n "$preset_id" ] && curl_args+=(--data-urlencode "id=${preset_id}")
            curl "${curl_args[@]}"
            ;;
        *)
            # 其余类型：文件上传（file 字段）

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/aippt.sh (reported line 202)May include surrounding context.

sh
[ -n "$senior_opts" ] && curl_args+=(--data-urlencode "senior_options=${senior_opts}")
            [ -n "$is_web_search" ] && curl_args+=(--data-urlencode "is_web_search=${is_web_search}")
            [ -n "$preset_id" ] && curl_args+=(--data-urlencode "id=${preset_id}")
            curl "${curl_args[@]}"
            ;;
        *)
            # 其余类型:文件上传(file 字段)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/aippt.sh (reported line 315)May include surrounding context.

sh
cmd_word() {
    local task_id="${1:?用法: word <task_id>}"
    local token=$(get_token)
    curl -s --max-time 180 -N "${BASE_URL}/api/ai/chat/v2/word?task_id=${task_id}" \
        -H "x-api-key: ${APP_KEY}" -H "x-channel;" -H "x-token: ${token}"
}

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/aippt.sh (reported line 315)May include surrounding context.

sh
cmd_word() {
    local task_id="${1:?用法: word <task_id>}"
    local token=$(get_token)
    curl -s --max-time 180 -N "${BASE_URL}/api/ai/chat/v2/word?task_id=${task_id}" \
        -H "x-api-key: ${APP_KEY}" -H "x-channel;" -H "x-token: ${token}"
}

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/aippt.sh (reported line 1148)May include surrounding context.

sh
curl_args+=(-F "files=@${f}")
    done
    local create_resp
    create_resp=$(curl "${curl_args[@]}")
    check_resp "$create_resp" "create"
    local task_id
    task_id=$(echo "$create_resp" | python3 -c "import sys,json;print(json.load(sys.stdin)['data']['id'])" 2>/dev/null)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The listed triggers include very general phrases such as '做 PPT', '生成 PPT', and '创建演示文稿', which are broad natural-language requests that could match ordinary conversation rather than a narrowly scoped invocation. The document does not provide exclusion conditions or negative examples to clarify when this skill should not activate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script sends user-specified file content to an external API via curl, including raw file uploads and markdown content ingestion, without an explicit privacy notice at the point of transfer. In an agent skill context, that omission is security-relevant because users may not realize local files are leaving the host environment.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/aippt.sh (reported line 315)May include surrounding context.

sh
cmd_word() {
    local task_id="${1:?用法: word <task_id>}"
    local token=$(get_token)
    curl -s --max-time 180 -N "${BASE_URL}/api/ai/chat/v2/word?task_id=${task_id}" \
        -H "x-api-key: ${APP_KEY}" -H "x-channel;" -H "x-token: ${token}"
}

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The function uploads one or more local reference documents to a third-party API using multipart form data, but there is no explicit consent or privacy warning at the operation site. Because these files may contain confidential business data, the main risk is unintended data exfiltration to an external service rather than code execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list includes very broad, generic phrases such as "PPT", "presentation", "slides", and "generate PPT", which are likely to match many normal user requests outside a narrowly intended invocation scope. This can cause unintended skill activation and route user content to an external PPT-generation service, increasing the chance of inappropriate data sharing or user confusion about which tool is handling the request.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
65% confidence
Finding

The trigger and configuration text includes controlling '语言' as part of the skill behavior, but the document does not explicitly state that language choice should be user-selected rather than assumed. This creates some risk that the skill could force or default to a language without clear user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

Natural-language strings throughout the script, including usage text and error messages, force a Chinese-language interaction model. Under the stated policy, a fixed language/locale should not be imposed unless the user is given a choice or the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.