officecli-pitch-deck

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:01 AM UTC
• Version: 1.0.3

Overview

The skill is mostly a coherent pitch-deck helper, but its setup instructions tell users to execute remote installer scripts directly without verification.

Install only if you trust the OfficeCLI publisher and are comfortable with the setup risk. Prefer downloading a pinned release from the official release page and verifying checksums or signatures instead of running the pipe-to-shell commands. The deck-building instructions themselves are scoped to local .pptx generation.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:16

Finding

Unverified Remote Installer Downloaded and Executed Directly

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16–17
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

bash

- **macOS / Linux**: `curl -fsSL https://d.officecli.ai/install.sh | bash`
- **Windows (PowerShell)**: `irm https://d.officecli.ai/install.ps1 | iex`

Technical Analysis

Both installation commands retrieve mutable content from d.officecli.ai and pass it directly to a command interpreter. The downloaded scripts are executed without prior inspection, version pinning, checksum validation, or cryptographic signature verification.

The effective installer payload is not contained in the audited project and can change after this skill has been reviewed. Consequently, the audit cannot establish what commands will execute when a user follows these instructions. Compromise of the distribution domain, hosting account, TLS termination infrastructure, or installer publication process would allow an attacker to substitute arbitrary shell or PowerShell code.

Installing OfficeCLI may be a legitimate prerequisite, but direct network-to-shell execution exceeds the minimum behavior necessary for the skill's declared presentation-generation functionality. The alternative GitHub release link mentioned at line 19 does not mitigate the unsafe primary installation instructions.

Attack Path

1. A user or AI agent loads the skill and determines that officecli is unavailable.
2. It follows the setup instructions on line 16 or 17.
3. An attacker compromises or gains control over the remote installer endpoint or its publication pipeline.
4. The endpoint returns an attacker-controlled shell or PowerShell script.
5. bash or iex executes the response immediately, with no opportunity for integrity verification.
6. The payload performs arbitrary actions under the privileges of the user who launched the command.

Impact Assessment

Successful exploitation provides arbitrary code execution with the invoking u ...[truncated 686 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove both direct execution pipelines:
   • curl ... | bash
   • irm ... | iex
2. Link to a version-pinned release artifact from the official release repository instead of a mutable installer URL.
3. Publish SHA-256 checksums through an independently protected channel and require users to verify the downloaded artifact before execution.
4. Cryptographically sign release artifacts and document signature verification using a pinned maintainer identity.
5. Separate download, inspection, verification, and execution into distinct commands.
6. Prefer a reputable package manager where the package identity and version can be pinned.
7. Run installation with ordinary user privileges unless a narrowly defined operation genuinely requires elevation.
8. Pin the expected OfficeCLI version in the skill and document a controlled update process rather than automatically trusting the latest remote script.
9. If an installer script remains necessary, include the reviewed, versioned script in the release or provide a stable commit-addressed URL so its contents cannot change after audit.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The explicit curl -fsSL https://d.officecli.ai/install.sh | bash pattern is a classic unsafe installer mechanism: it executes network-delivered content immediately without integrity verification or user inspection. If the endpoint, DNS, TLS trust chain, or distribution pipeline is compromised, arbitrary code runs with the user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md

If `officecli` is missing:

- **macOS / Linux**: `curl -fsSL https://d.officecli.ai/install.sh | bash`
- **Windows (PowerShell)**: `irm https://d.officecli.ai/install.ps1 | iex`

Verify with `officecli --version` (open a new terminal if PATH hasn't picked up). If install fails, download a binary from https://github.com/iOfficeAI/OfficeCLI/releases.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The markdown embeds Chinese text (5 赛道 arc templates) within otherwise English-only instructions, and later repeats 赛道 terminology as required navigation language. This introduces a language/locale constraint in the skill's natural-language guidance without offering the user a language choice or documenting a justified region-specific requirement.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md

**This skill is a scene layer on top of `officecli-pptx`.** Every pptx hard rule — visual delivery floor (title ≥ 36pt / body ≥ 18pt / title ≥ 2× body), 12-column grid on 33.87×19.05cm, 4 canonical palettes, chart-choice decision table, connector canon (`shape` / `from` / `to` / `tailEnd=triangle`), shell escape, resident + batch, Delivery Gate 1–5a — is inherited, not re-taught. This file adds only what **fundraising** needs on top: stage diagnosis (A / B / C), 5 赛道 arc templates, 10 key-slide recipes (cover / problem / solution / market / product / model / traction / team / financials / ask), pitch-specific numbers convention, a VC ship-check, and a pitch-specific fresh-eyes Gate 6.

When the pptx base rules cover it, the text here says `→ see pptx v2 §X`. Read `skills/officecli-pptx/SKILL.md` first if you have not.

## Setup

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md

**This skill is a scene layer on top of `officecli-pptx`.** Every pptx hard rule — visual delivery floor (title ≥ 36pt / body ≥ 18pt / title ≥ 2× body), 12-column grid on 33.87×19.05cm, 4 canonical palettes, chart-choice decision table, connector canon (`shape` / `from` / `to` / `tailEnd=triangle`), shell escape, resident + batch, Delivery Gate 1–5a — is inherited, not re-taught. This file adds only what **fundraising** needs on top: stage diagnosis (A / B / C), 5 赛道 arc templates, 10 key-slide recipes (cover / problem / solution / market / product / model / traction / team / financials / ask), pitch-specific numbers convention, a VC ship-check, and a pitch-specific fresh-eyes Gate 6.

When the pptx base rules cover it, the text here says `→ see pptx v2 §X`. Read `skills/officecli-pptx/SKILL.md` first if you have not.

## Setup

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill includes setup instructions that fetch and execute remote shell/PowerShell scripts (curl ... | bash, irm ... | iex). This creates a direct supply-chain and arbitrary code execution path on the analyst/user machine, and it is not necessary to embed such execution guidance inside a content-generation skill file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.