ClawHub
Back to skill

Security audit

Html2pptx Shape

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a real HTML-to-PPTX converter, but it automatically fetches image URLs from input HTML without clear network limits or opt-in controls.

Install only if you are comfortable reviewing HTML inputs before conversion. Avoid using it on untrusted HTML unless remote image fetching is disabled or run in a network-restricted environment, and prefer pinning dependencies before production use.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill documentation describes capabilities that imply file read, file write, and network access, but no corresponding permissions are declared. This creates a transparency and governance gap: users or orchestrators may execute a skill with broader effective access than expected, increasing the risk of unintended local file access, overwriting outputs, or outbound requests to attacker-controlled resources.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The stated purpose focuses on HTML-to-PPTX conversion, but the docs also indicate support for remote image URLs and HTTP(S) fetching via requests. Undisclosed network retrieval can be abused for SSRF-like behavior, privacy leakage, or unexpected communication with external hosts when processing untrusted HTML.

Description-Behavior Mismatch

Medium
Confidence
76% confidence
Finding
Advertising Playwright screenshot functionality in a skill primarily presented as a native shape converter expands the operational scope beyond what users may expect. Browser automation can introduce additional attack surface, including network access, script execution in rendered pages, and accidental handling of active web content.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The converter issues HTTP(S) requests to attacker-controlled URLs embedded in the input HTML via requests.get(src) with no allowlist, timeout, size limit, or network restrictions. This creates an SSRF-style outbound fetch primitive that can be abused for internal network probing, unexpected data egress, or denial of service through slow or large responses.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The skill fetches remote image URLs directly from untrusted HTML input without warning users that conversion may trigger outbound network access. In this context, an HTML-to-PPTX converter is expected to process local content, so hidden network activity makes the SSRF/privacy risk more dangerous because users and operators may run it in trusted environments with internal network reachability.

Unpinned Dependencies

Low
Category
Supply Chain
Content
python-pptx>=0.6.21
beautifulsoup4>=4.12.0
pillow>=10.0.0
requests>=2.31.0
Confidence
96% confidence
Finding
The dependency is specified with only a minimum version bound, so builds may resolve to different versions over time. This weakens supply-chain reproducibility and can unintentionally introduce vulnerable or breaking releases into the skill environment.

Unpinned Dependencies

Low
Category
Supply Chain
Content
python-pptx>=0.6.21
beautifulsoup4>=4.12.0
pillow>=10.0.0
requests>=2.31.0
cssutils>=2.7.0
Confidence
96% confidence
Finding
Using an unpinned beautifulsoup4 version allows dependency resolution to drift between installations. That increases supply-chain risk and makes it harder to ensure the skill is consistently deployed with reviewed package versions.

Unpinned Dependencies

Low
Category
Supply Chain
Content
python-pptx>=0.6.21
beautifulsoup4>=4.12.0
pillow>=10.0.0
requests>=2.31.0
cssutils>=2.7.0
premailer>=3.10.0
Confidence
98% confidence
Finding
Pillow is unpinned, which is especially risky because image-parsing libraries frequently receive security fixes for malformed input handling. In a skill that converts HTML and likely processes embedded or external images, dependency drift can expose the runtime to newly introduced or unfixed image parsing flaws.

Unpinned Dependencies

Low
Category
Supply Chain
Content
python-pptx>=0.6.21
beautifulsoup4>=4.12.0
pillow>=10.0.0
requests>=2.31.0
cssutils>=2.7.0
premailer>=3.10.0
playwright>=1.40.0
Confidence
97% confidence
Finding
Requests is declared with only a lower bound, so the actual installed version may vary and may include versions affected by credential leakage, TLS, redirect, or proxy-handling issues. Because this skill description mentions fetching external CSS, network-facing behavior makes weak version control more dangerous.

Unpinned Dependencies

Low
Category
Supply Chain
Content
beautifulsoup4>=4.12.0
pillow>=10.0.0
requests>=2.31.0
cssutils>=2.7.0
premailer>=3.10.0
playwright>=1.40.0
Confidence
94% confidence
Finding
An unpinned cssutils dependency introduces build-time and runtime variability. While not inherently exploitable by itself, it enlarges supply-chain exposure and makes security review of the deployed package set unreliable.

Unpinned Dependencies

Low
Category
Supply Chain
Content
pillow>=10.0.0
requests>=2.31.0
cssutils>=2.7.0
premailer>=3.10.0
playwright>=1.40.0
Confidence
94% confidence
Finding
Premailer is not pinned to a specific release, so future installs may pull different versions with different behaviors or vulnerabilities. In a tool that inlines and processes CSS/HTML, reproducibility matters for both security and correctness.

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.31.0
cssutils>=2.7.0
premailer>=3.10.0
playwright>=1.40.0
Confidence
97% confidence
Finding
Playwright is unpinned, which is more sensitive than many libraries because browser automation packages bring complex browser/runtime dependencies and regularly receive security fixes. In an HTML-to-PPTX workflow, rendering untrusted HTML through a browser engine can increase the consequences of stale or drifting versions.

Known Vulnerable Dependency: pillow — 10 advisory(ies): CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +7 more

Critical
Category
Supply Chain
Confidence
79% confidence
Finding
The static finding correctly identifies that Pillow has had numerous serious advisories, and this file does not constrain it to a known-safe fixed version. Given the skill's purpose of converting HTML slides and likely handling embedded or linked images, malformed image inputs could trigger denial of service or, depending on the resolved version and reachable code paths, more severe parser vulnerabilities.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High
Category
Supply Chain
Confidence
82% confidence
Finding
Requests has multiple known advisories and the dependency is not pinned to a patched version, so deployments may resolve to an affected release. Since the skill description mentions automatically embedding external CSS, network requests to attacker-controlled URLs could expose credential leakage, redirect/proxy mishandling, or other HTTP client weaknesses depending on how the package is used.

Static analysis

No suspicious patterns detected.