ClawHub
Back to skill

Security audit

officecli-pptx

Security checks across malware telemetry and agentic risk

Overview

The skill is coherent for PowerPoint automation, but its setup tells agents to run unverified remote installer scripts directly in a shell.

Review the installer before running it, prefer a pinned release or verified binary from a trusted source, and install only if you are comfortable giving the OfficeCLI installer local code-execution authority. The skill itself does not show hidden data collection or destructive behavior.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Vague Triggers

High
Confidence
93% confidence
Finding
The activation condition lacks clear boundaries and exclusions, so the skill may be invoked for ambiguous requests where a PPTX-specific tool is unnecessary. In this context, ambiguity matters because the skill includes instructions to install and use external software, making accidental activation materially riskier than a harmless routing mistake.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The activation condition lacks clear boundaries and exclusions, so the skill may be invoked for ambiguous requests where a PPTX-specific tool is unnecessary. In this context, ambiguity matters because the skill includes instructions to install and use external software, making accidental activation materially riskier than a harmless routing mistake.

External Script Fetching

High
Category
Supply Chain
Content
If `officecli` is missing:

- **macOS / Linux**: `curl -fsSL https://d.officecli.ai/install.sh | bash`
- **Windows (PowerShell)**: `irm https://d.officecli.ai/install.ps1 | iex`

Verify with `officecli --version` (open a new terminal if PATH hasn't picked up). If install fails, download a binary from https://github.com/iOfficeAI/OfficeCLI/releases.
Confidence
99% confidence
Finding
curl -fsSL https://d.officecli.ai/install.sh | bash

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.