Security audit

officecli-morph-ppt

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its Morph PowerPoint purpose, but it needs Review because its setup runs unverified remote installer scripts and one Bash verifier can turn crafted deck content into code execution.

Install only if you review and install OfficeCLI through a verified release path yourself. Do not let an agent run the pipe-to-shell setup commands, prefer the Python helper over the Bash helper, avoid verifying untrusted PPTX files with morph-helpers.sh, and back up decks before running cleanup or demo build scripts.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:16
Finding: Unverified Remote Installation Scripts Are Executed Directly by a Shell
Content: View full analysis
Remediation: View remediation
/" # Compare against a checksum published through a trusted release channel. printf '%s %s\n' '' 'officecli.tar.gz' | sha256sum --check - # Inspect or extract the verified artifact, then install it with the minimum # permissions necessary. ``` Equivalent integrity verification should be documented for Windows. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: reference/morph-helpers.sh:191
Finding: Presentation JSON Is Interpolated into Executable Python Source
Content: View full analysis
/dev/null) local curr_json="$shapes_json" local duplicates duplicates=$(python3 -c " import sys, json try: prev_data = json.loads('''$prev_json''') curr_data = json.loads('''$curr_json''') ``` ### Technical Analysis The helper obtains JSON from a presentation and embeds it directly inside the source text passed to `python3 -c`. The values are placed inside Python triple-quoted string literals without source-code escaping. Presentation text, shape names, metadata, or other serialized values may be attacker-controlled. If such a value contains a terminating triple-single-quote sequence, it can close the intended Python string literal. Additional characters can then be interpreted as Python syntax rather than JSON data. Shell double-quote handling does not provide Python-language escaping. JSON escaping also does not guarantee safety when JSON is embedded into a different programming language's source code. As a result, a crafted presentation can potentially convert a verification operation into arbitrary Python execution. The separate Python helper, `reference/morph-helpers.py`, does not use this source interpolation pattern: it receives `officecli` output as process data and calls `json.loads()` directly. That approach is substantially safer. ### Attack Path 1. An attacker supplies a crafted `.pptx` file or causes attacker-controlled text or metadata to be included in a deck. 2. A user sources `reference/morph-helpers.sh` and invokes `morph_verify_slide` or `morph_final_chec ...[truncated 1509 chars]
Remediation: View remediation
"$prev_file" || return 1 printf '%s' "$shapes_json" >"$curr_file" duplicates=$(python3 - "$prev_file" "$curr_file" <<'PY' import json import sys with open(sys.argv[1], "r", encoding="utf-8") as stream: prev_data = json.load(stream) with open(sys.argv[2], "r", encoding="utf-8") as stream: curr_data = json.load(stream) # Perform duplicate detection using prev_data and curr_data strictly as data. PY ) ``` The existing native Python helper may also be used as the canonical implementation, with the Bash helper reduced to a thin wrapper around it. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (66)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description says this skill is for creating presentations whose defining purpose is smooth cross-slide animation via Morph, as a scene layer over a broader PPTX generator, and specifically says not to use it for generic decks or pitch decks unless cross-slide motion is the key requirement. The code instead hardcodes a dark investor pitch template with six named business slides and 403 mostly static elements. While it does set Morph transitions on slides 2–6, that is only a small part of the behavior and there is no evident implementation of continuous object continuity across slides (matching shapes that move/grow/rotate between slides). The code’s primary purpose is therefore materially different: it is an investor pitch template builder with Morph enabled, not a generic morph-animation skill layer.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: The command curl -fsSL https://d.officecli.ai/install.sh | bash causes immediate execution of unverified remote content in the local shell. This is a classic arbitrary-code-execution anti-pattern and is especially risky in an agent skill because it can normalize unsafe behavior and lead to compromise of the host environment if the remote script is modified or intercepted.
Content: Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.
md
If `officecli` is missing: - **macOS / Linux**: `curl -fsSL https://d.officecli.ai/install.sh | bash` - **Windows (PowerShell)**: `irm https://d.officecli.ai/install.ps1 | iex` Verify with `officecli --version` (open a new terminal if PATH hasn't picked up). If install fails, download a binary from https://github.com/iOfficeAI/OfficeCLI/releases.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill explicitly contains shell commands and instructs the agent to run them, but it declares no allowed-tools or permission boundary. That omission increases the chance an agent executes shell actions implicitly or with broader privileges than intended, especially because the skill also includes installation and file-modification workflows.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The setup section instructs users to execute remote scripts directly from the network using shell and PowerShell pipelines, without integrity verification or an explicit warning. This is dangerous because any compromise of the remote host, DNS, TLS termination, or distribution path can lead to arbitrary code execution on the user's system.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · reference/morph-helpers.py (reported line 41)May include surrounding context.
python
def _run(*args): """Run a command, return (returncode, stdout, stderr).""" result = subprocess.run(list(args), capture_output=True, text=True) return result.returncode, result.stdout, result.stderr

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The helper exposes a destructive cleanup command that removes shapes from the deck, which exceeds a narrowly described 'helper/verification' role and can silently alter user content. In a skill pipeline, this broadens the action surface from generating/verifying morph transitions to deleting presentation elements, creating risk of integrity loss or unintended destructive changes if invoked automatically or on the wrong deck.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.
md
# Morph Design Essentials `skills/officecli-pptx/SKILL.md` §Requirements / §Design Principles / §Visual delivery floor is the **source of truth for type hierarchy, contrast, and palette picking** in every pptx, morph or not. This file narrows that floor to the **stage-feel register** a morph deck typically shoots for: darker backgrounds, larger hero type, deeper opacity range for scene actors, and per-slide text-width generosity that survives `#sN-*` ghost churn. Where pptx SKILL.md already states a rule, the guidance here is an additive override **only if the slide is actively in a morph pair** — otherwise defer upward. ---

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.
md
# Morph Design Essentials `skills/officecli-pptx/SKILL.md` §Requirements / §Design Principles / §Visual delivery floor is the **source of truth for type hierarchy, contrast, and palette picking** in every pptx, morph or not. This file narrows that floor to the **stage-feel register** a morph deck typically shoots for: darker backgrounds, larger hero type, deeper opacity range for scene actors, and per-slide text-width generosity that survives `#sN-*` ghost churn. Where pptx SKILL.md already states a rule, the guidance here is an additive override **only if the slide is actively in a morph pair** — otherwise defer upward. ---

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 539)May include surrounding context.
md
# Morph Design Essentials `skills/officecli-pptx/SKILL.md` §Requirements / §Design Principles / §Visual delivery floor is the **source of truth for type hierarchy, contrast, and palette picking** in every pptx, morph or not. This file narrows that floor to the **stage-feel register** a morph deck typically shoots for: darker backgrounds, larger hero type, deeper opacity range for scene actors, and per-slide text-width generosity that survives `#sN-*` ghost churn. Where pptx SKILL.md already states a rule, the guidance here is an additive override **only if the slide is actively in a morph pair** — otherwise defer upward. ---

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · reference/pptx-design.md (reported line 8)May include surrounding context.
md
# Morph Design Essentials `skills/officecli-pptx/SKILL.md` §Requirements / §Design Principles / §Visual delivery floor is the **source of truth for type hierarchy, contrast, and palette picking** in every pptx, morph or not. This file narrows that floor to the **stage-feel register** a morph deck typically shoots for: darker backgrounds, larger hero type, deeper opacity range for scene actors, and per-slide text-width generosity that survives `#sN-*` ghost churn. Where pptx SKILL.md already states a rule, the guidance here is an additive override **only if the slide is actively in a morph pair** — otherwise defer upward. ---

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · reference/styles/INDEX.md (reported line 104)May include surrounding context.
md
## Quick Lookup by Use Case | Use Case | Recommended Styles | | ---------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Tech / AI / SaaS** | dark--tech-cosmos, dark--cyber-future, light--isometric-clean, mixed--chromatic-aberration, light--firmwise-saas, light--fluid-gradient | | **Investment / Pitch / Fundraising** | dark--investor-pitch, dark--premium-navy, light--project-proposal, light--glassmorphism-vc, dark--obsidian-amber |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · reference/styles/INDEX.md (reported line 111)May include surrounding context.
md
| **Corporate / Business / Reports** | light--minimal-corporate, light--minimal-product, dark--premium-navy, vivid--pink-editorial, warm--sunset-mosaic, warm--coral-culture | | **Brand / Launch / Marketing** | warm--brand-refresh, warm--creative-marketing, vivid--playful-marketing, warm--minimal-brand, vivid--bauhaus-electric | | **Design / Architecture / Art** | bw--swiss-bauhaus, bw--brutalist-raw, dark--architectural-plan, mixed--duotone-split, dark--midnight-blueprint, mixed--bauhaus-blocks, dark--aurora-softedge, warm--monument-editorial | | **Education / Training / Courseware** | light--training-interactive, warm--playful-organic, vivid--candy-stripe, warm--bloom-academy | | **Keynotes / Launch Events / Galas** | dark--spotlight-stage, dark--liquid-flow, vivid--energy-neon | | **Creative Agency / Studio** | dark--sage-grain, mixed--bauhaus-blocks, dark--circle-digital, vivid--bauhaus-electric, mixed--spectral-grid | | **Developer / Technical** | dark--cyber-future, dark--blueprint-grid, dark--tech-cosmos |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · reference/styles/INDEX.md (reported line 112)May include surrounding context.
md
| **Brand / Launch / Marketing** | warm--brand-refresh, warm--creative-marketing, vivid--playful-marketing, warm--minimal-brand, vivid--bauhaus-electric | | **Design / Architecture / Art** | bw--swiss-bauhaus, bw--brutalist-raw, dark--architectural-plan, mixed--duotone-split, dark--midnight-blueprint, mixed--bauhaus-blocks, dark--aurora-softedge, warm--monument-editorial | | **Education / Training / Courseware** | light--training-interactive, warm--playful-organic, vivid--candy-stripe, warm--bloom-academy | | **Keynotes / Launch Events / Galas** | dark--spotlight-stage, dark--liquid-flow, vivid--energy-neon | | **Creative Agency / Studio** | dark--sage-grain, mixed--bauhaus-blocks, dark--circle-digital, vivid--bauhaus-electric, mixed--spectral-grid | | **Developer / Technical** | dark--cyber-future, dark--blueprint-grid, dark--tech-cosmos | | **Eco / Nature / Organic** | warm--earth-organic, warm--minimal-brand, light--spring-launch |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · reference/styles/INDEX.md (reported line 114)May include surrounding context.
md
| **Education / Training / Courseware** | light--training-interactive, warm--playful-organic, vivid--candy-stripe, warm--bloom-academy | | **Keynotes / Launch Events / Galas** | dark--spotlight-stage, dark--liquid-flow, vivid--energy-neon | | **Creative Agency / Studio** | dark--sage-grain, mixed--bauhaus-blocks, dark--circle-digital, vivid--bauhaus-electric, mixed--spectral-grid | | **Developer / Technical** | dark--cyber-future, dark--blueprint-grid, dark--tech-cosmos | | **Eco / Nature / Organic** | warm--earth-organic, warm--minimal-brand, light--spring-launch | | **Cultural Creative / Magazine / Story** | dark--editorial-story, light--watercolor-wash, light--bold-type, warm--monument-editorial | | **Sci-Fi / Space / Futuristic** | dark--space-odyssey, dark--cosmic-neon, dark--cyber-future |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · reference/styles/INDEX.md (reported line 115)May include surrounding context.
md
| **Keynotes / Launch Events / Galas** | dark--spotlight-stage, dark--liquid-flow, vivid--energy-neon | | **Creative Agency / Studio** | dark--sage-grain, mixed--bauhaus-blocks, dark--circle-digital, vivid--bauhaus-electric, mixed--spectral-grid | | **Developer / Technical** | dark--cyber-future, dark--blueprint-grid, dark--tech-cosmos | | **Eco / Nature / Organic** | warm--earth-organic, warm--minimal-brand, light--spring-launch | | **Cultural Creative / Magazine / Story** | dark--editorial-story, light--watercolor-wash, light--bold-type, warm--monument-editorial | | **Sci-Fi / Space / Futuristic** | dark--space-odyssey, dark--cosmic-neon, dark--cyber-future | | **Luxury / Premium** | dark--luxury-minimal, dark--premium-navy, warm--minimal-brand, dark--velvet-rose |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · reference/styles/INDEX.md (reported line 120)May include surrounding context.
md
| **Keynotes / Launch Events / Galas** | dark--spotlight-stage, dark--liquid-flow, vivid--energy-neon | | **Creative Agency / Studio** | dark--sage-grain, mixed--bauhaus-blocks, dark--circle-digital, vivid--bauhaus-electric, mixed--spectral-grid | | **Developer / Technical** | dark--cyber-future, dark--blueprint-grid, dark--tech-cosmos | | **Eco / Nature / Organic** | warm--earth-organic, warm--minimal-brand, light--spring-launch | | **Cultural Creative / Magazine / Story** | dark--editorial-story, light--watercolor-wash, light--bold-type, warm--monument-editorial | | **Sci-Fi / Space / Futuristic** | dark--space-odyssey, dark--cosmic-neon, dark--cyber-future | | **Luxury / Premium** | dark--luxury-minimal, dark--premium-navy, warm--minimal-brand, dark--velvet-rose |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · reference/styles/INDEX.md (reported line 116)May include surrounding context.
md
| **Creative Agency / Studio** | dark--sage-grain, mixed--bauhaus-blocks, dark--circle-digital, vivid--bauhaus-electric, mixed--spectral-grid | | **Developer / Technical** | dark--cyber-future, dark--blueprint-grid, dark--tech-cosmos | | **Eco / Nature / Organic** | warm--earth-organic, warm--minimal-brand, light--spring-launch | | **Cultural Creative / Magazine / Story** | dark--editorial-story, light--watercolor-wash, light--bold-type, warm--monument-editorial | | **Sci-Fi / Space / Futuristic** | dark--space-odyssey, dark--cosmic-neon, dark--cyber-future | | **Luxury / Premium** | dark--luxury-minimal, dark--premium-navy, warm--minimal-brand, dark--velvet-rose | | **Productivity / Motivation** | dark--neon-productivity, dark--cyber-future |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · reference/styles/INDEX.md (reported line 117)May include surrounding context.
md
| **Developer / Technical** | dark--cyber-future, dark--blueprint-grid, dark--tech-cosmos | | **Eco / Nature / Organic** | warm--earth-organic, warm--minimal-brand, light--spring-launch | | **Cultural Creative / Magazine / Story** | dark--editorial-story, light--watercolor-wash, light--bold-type, warm--monument-editorial | | **Sci-Fi / Space / Futuristic** | dark--space-odyssey, dark--cosmic-neon, dark--cyber-future | | **Luxury / Premium** | dark--luxury-minimal, dark--premium-navy, warm--minimal-brand, dark--velvet-rose | | **Productivity / Motivation** | dark--neon-productivity, dark--cyber-future | | **Wellness / Health / Lifestyle** | warm--vital-bloom, warm--playful-organic, light--spring-launch |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · reference/styles/INDEX.md (reported line 118)May include surrounding context.
md
| **Eco / Nature / Organic** | warm--earth-organic, warm--minimal-brand, light--spring-launch | | **Cultural Creative / Magazine / Story** | dark--editorial-story, light--watercolor-wash, light--bold-type, warm--monument-editorial | | **Sci-Fi / Space / Futuristic** | dark--space-odyssey, dark--cosmic-neon, dark--cyber-future | | **Luxury / Premium** | dark--luxury-minimal, dark--premium-navy, warm--minimal-brand, dark--velvet-rose | | **Productivity / Motivation** | dark--neon-productivity, dark--cyber-future | | **Wellness / Health / Lifestyle** | warm--vital-bloom, warm--playful-organic, light--spring-launch | | **Finance / Investment** | dark--obsidian-amber, dark--investor-pitch, light--glassmorphism-vc |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · reference/styles/INDEX.md (reported line 119)May include surrounding context.
md
| **Cultural Creative / Magazine / Story** | dark--editorial-story, light--watercolor-wash, light--bold-type, warm--monument-editorial | | **Sci-Fi / Space / Futuristic** | dark--space-odyssey, dark--cosmic-neon, dark--cyber-future | | **Luxury / Premium** | dark--luxury-minimal, dark--premium-navy, warm--minimal-brand, dark--velvet-rose | | **Productivity / Motivation** | dark--neon-productivity, dark--cyber-future | | **Wellness / Health / Lifestyle** | warm--vital-bloom, warm--playful-organic, light--spring-launch | | **Finance / Investment** | dark--obsidian-amber, dark--investor-pitch, light--glassmorphism-vc |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · reference/styles/INDEX.md (reported line 121)May include surrounding context.
md
| **Luxury / Premium** | dark--luxury-minimal, dark--premium-navy, warm--minimal-brand, dark--velvet-rose | | **Productivity / Motivation** | dark--neon-productivity, dark--cyber-future | | **Wellness / Health / Lifestyle** | warm--vital-bloom, warm--playful-organic, light--spring-launch | | **Finance / Investment** | dark--obsidian-amber, dark--investor-pitch, light--glassmorphism-vc |

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script hardcodes all user-visible slide text in Chinese across the generated presentation without any parameterization, locale negotiation, or documented constraint that this style is Chinese-only. In a general-purpose presentation skill, this can cause unauthorized language coercion, misleading outputs, and downstream policy/compliance issues when users expect content in another language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This shell script hard-codes major user-visible presentation text in Chinese, including the subtitle and tagline, without offering a language or locale option. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file embeds all user-visible slide text in Chinese across the presentation, which effectively forces a specific language/locale. Under the policy, locale constraints should either be optional for the user or clearly documented as a justified region-specific requirement, neither of which appears in this script.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: User-visible strings such as the title and slide content are fixed in Chinese, for example 未来已来：2050 and other Chinese text throughout the generated deck. Under the language/locale policy, forcing a specific language without user opt-in or justification is a natural-language policy issue.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.