Security audit

Html2pptx Shape

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real HTML-to-PPTX converter, but it can let an input HTML file trigger unrestricted network requests and reads of local files outside the presentation folder.

Review before installing or using this with documents from others. It is safest only for trusted local HTML/CSS/images in a sandboxed or offline environment. Before broader use, the publisher should confine stylesheet paths to the input directory, reject absolute/traversal paths, make remote asset fetching explicit and opt-in, block private/localhost destinations, add timeouts and size limits, and pin dependencies.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: index.py:483
Finding: Server-Side Request Forgery Through Unrestricted Remote Image Loading
Content: View full analysis
``` Alternatively, the URL can target a private network host, link-local service, or cloud metadata endpoint. 2. The attacker persuades a user or automated service to convert the HTML using `index.py`. 3. `create_image_shape()` extracts the attacker-controlled `src` value. 4. The converter executes `requests.get(src)` from its own network environment. 5. The request reaches the targeted internal service. 6. The response is downloaded and passed to the image-processing/PPTX pipeline. Differences in timing ...[truncated 956 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: index.py:198
Finding: Arbitrary Local File Read Through Stylesheet Path Traversal
Content: View full analysis
` ...[truncated 1942 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: index.py:476
Finding: Denial of Service Through Unbounded Image Decoding and Downloads
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (29)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This finding again indicates the skill claims native PPTX shape generation but may only perform CSS embedding or preprocessing. In security terms, severe description-behavior mismatch increases the chance of deceptive capability approval and makes any file/network activity more suspicious because the operator cannot reliably predict what the skill will do.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This finding again indicates the skill claims native PPTX shape generation but may only perform CSS embedding or preprocessing. In security terms, severe description-behavior mismatch increases the chance of deceptive capability approval and makes any file/network activity more suspicious because the operator cannot reliably predict what the skill will do.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This finding again indicates the skill claims native PPTX shape generation but may only perform CSS embedding or preprocessing. In security terms, severe description-behavior mismatch increases the chance of deceptive capability approval and makes any file/network activity more suspicious because the operator cannot reliably predict what the skill will do.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README advertises automatic inlining of external CSS but does not warn that processing HTML with -based styles may trigger outbound network requests or fetch attacker-controlled resources. In a conversion tool, this can expose users to SSRF-like behavior, privacy leakage, unexpected dependency on remote content, or processing of untrusted inputs without informed consent.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill declares dependencies and documented behavior that imply file reads, file writes, and possible network access, but it does not declare any tool scope or permissions boundaries. In an agent environment, undeclared capabilities reduce transparency and can allow the skill to access local files or fetch remote resources in ways the user did not explicitly approve.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The documentation says images may come from URLs but does not warn that processing untrusted HTML can trigger outbound network requests. This can leak IP/addressing metadata, contact attacker-controlled hosts, and create SSRF-like behavior depending on the runtime environment and what URL schemes or destinations are allowed.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The converter automatically fetches remote images when an HTML file contains http(s) image sources, which expands a local file conversion task into a networked operation. This can leak environment metadata such as IP address and access timing to attacker-controlled servers, and can be abused for SSRF-style access to internal resources if untrusted HTML is processed.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Remote image retrieval happens silently with no user-facing warning, so users may believe they are performing an offline HTML-to-PPTX conversion while the tool contacts external servers. In this skill context, that makes the behavior more dangerous because the advertised function suggests document transformation, not network egress, and untrusted HTML can trigger unexpected data transmission.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This Python file contains natural-language documentation and function docstrings in Chinese, including the top-level description and the main function docstring. Under the policy, forcing a specific language without offering a user choice or documenting a justified locale constraint is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script takes href values from HTML and resolves them with simple path joining, allowing relative paths such as '../' to escape the HTML directory and read arbitrary local files that exist on the host. Although the tool is intended to inline CSS, in a workflow that processes untrusted HTML this becomes a local file disclosure primitive and can expose sensitive files if they are readable by the process.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 75% confidence
Finding: 文件整体以中文编写，未见提供其他语言版本、语言切换说明或用户可选的语言/locale 选项。若组织要求避免在无用户选择的情况下强制特定语言，这种单一语言说明可能构成自然语言层面的策略问题。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The natural-language instructions and usage guidance are presented in Chinese, and the file does not indicate that this language choice is optional or region-specific. Per the policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The documentation explicitly states '自动跳过远程 CSS（http/https 开头）', which narrows behavior to local CSS only. Elsewhere the skill description broadly says it will '自动内嵌外部 CSS', so the inline documentation materially qualifies the behavior rather than matching the advertised capability.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 72% confidence
Finding: The overall documentation emphasizes complete preservation of CSS styles/layout and native-shape conversion, which suggests broad visual fidelity. The later comparison table clarifies that screenshot-based high-fidelity rendering is not supported, creating a documentation-level tension about expected output behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The HTML root element sets lang="zh-CN", and the page content is primarily Chinese, which imposes a specific language/locale choice in the skill artifact. The file does not indicate that users can opt into another language or that the Chinese-only locale is required for a region-specific purpose.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The document declares lang="zh-CN", which imposes a specific language/locale on users. Under the policy, locale-specific behavior should either be optional or clearly justified as region-specific; this file provides neither.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The document sets lang="zh-CN", which hard-codes a specific language/locale. Under the policy, forcing a locale without user opt-in or clear justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 98% confidence
Finding: The dependency is specified with a lower bound only, which allows future builds to resolve to different versions over time. This weakens reproducibility and can unintentionally introduce vulnerable or breaking upstream releases into the build.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
python-pptx>=0.6.21 beautifulsoup4>=4.12.0 pillow>=10.0.0 requests>=2.31.0

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 98% confidence
Finding: Using an unpinned beautifulsoup4 version means installations are not reproducible and may drift to unreviewed upstream releases. That increases supply-chain risk and makes it harder to verify whether a deployed environment includes a safe version.
Content: Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.
text
python-pptx>=0.6.21 beautifulsoup4>=4.12.0 pillow>=10.0.0 requests>=2.31.0 cssutils>=2.7.0

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 99% confidence
Finding: Pillow is unpinned, so deployments may pull different releases, including ones later found to have image parsing vulnerabilities. Because this skill processes HTML and likely embedded or external images, unsafe or inconsistent Pillow versions increase the chance of exposing image-handling attack surface.
Content: Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.
text
python-pptx>=0.6.21 beautifulsoup4>=4.12.0 pillow>=10.0.0 requests>=2.31.0 cssutils>=2.7.0 premailer>=3.10.0

Unverifiable Dependency: pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: The manifest does not pin Pillow, and Pillow has a substantial history of security advisories, including image parsing and resource-consumption issues. Because this skill converts HTML slides and likely handles attacker-controlled images, the inability to verify the installed Pillow version materially increases risk.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 99% confidence
Finding: Requests is unpinned, allowing installation of varying versions with different security properties. In a skill that likely fetches external CSS or assets from URLs, this can expose the runtime to known client-side request issues or credential-handling flaws present in some releases.
Content: Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.
text
python-pptx>=0.6.21 beautifulsoup4>=4.12.0 pillow>=10.0.0 requests>=2.31.0 cssutils>=2.7.0 premailer>=3.10.0 playwright>=1.40.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: Requests has multiple historical advisories, and without an exact pin there is no assurance the deployed version is unaffected. This matters more in this skill because it likely performs outbound HTTP requests for remote CSS, images, or other assets, increasing exposure to request-handling flaws.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 97% confidence
Finding: An unpinned cssutils dependency introduces non-reproducible builds and potential exposure to insecure upstream changes. While not inherently exploitable on its own, it increases supply-chain uncertainty in a component that parses attacker-influenced CSS.
Content: Scanner excerpt · requirements.txt (reported line 5)May include surrounding context.
text
beautifulsoup4>=4.12.0 pillow>=10.0.0 requests>=2.31.0 cssutils>=2.7.0 premailer>=3.10.0 playwright>=1.40.0

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 97% confidence
Finding: Premailer is specified as a minimum version only, so environments may install different releases over time. This creates avoidable supply-chain and reproducibility risk for a library used to transform HTML/CSS content.
Content: Scanner excerpt · requirements.txt (reported line 6)May include surrounding context.
text
pillow>=10.0.0 requests>=2.31.0 cssutils>=2.7.0 premailer>=3.10.0 playwright>=1.40.0

Static analysis

No suspicious patterns detected.