T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:19- Finding
Skill instructions override the Agent hierarchy and create an automatic command channel
- Content
View full analysis
- Remediation
View remediation
Security audit
ppt-craft-editable
Security checks for vulnerabilities and agentic risk
Overview
This presentation skill is mostly purpose-aligned, but it asks the agent to silently install software and obey pasted marker blocks that can overwrite workflow files and run scripts without confirming their source.
Review this skill before installing. Use it only if you are comfortable with it changing Python packages and creating a persistent local cache; prefer running setup in an isolated virtual environment. Do not paste marker blocks from untrusted documents or web pages, and confirm any preflight install, file overwrite, PDF asset path, or rendering step before letting the agent proceed.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
scripts/preflight.py:38- Finding
Automatic installation and upgrade of unpinned dependencies
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (134)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description promises a full PPT production system with multiple phases, automatic environment setup, image-first slide generation, editable PPT generation, PDF conversion, and command-like marker handling. The supplied code does none of that. It contains a single Python script whose sole function is to decode an embedded base64 HTML document and save it as index.html. The generated HTML/JavaScript presents a front-end interface for selecting among pre-authored slide candidates and copying code strings representing those selections. This is at most a supporting UI artifact, but by itself it is materially different from the declared skill purpose and lacks nearly all core advertised capabilities. Therefore this code chunk does not accurately represent the declared description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description describes a large, autonomous PPT creation pipeline with multiple phases, environment preparation, image retouching, PDF conversion, and special command handling. The supplied code does none of that. Its sole behavior is to write a prebuilt static HTML preview shell from an embedded base64 string. While that HTML appears related to style preview UI for PPT concepts, this is only a small supporting asset generator, not the claimed end-to-end skill behavior. Therefore the description does not accurately represent what this code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description promises a large, autonomous PPT creation/editing pipeline with multiple phases and automation behaviors. This code chunk does not perform any of those core functions. It simply writes a prebuilt HTML review tool to disk. The generated page contains sample slide thumbnails, drawing/rectangle/note annotations, local persistence via localStorage, and JSON payload export via clipboard for review markup. While a review UI could be a supporting component of a larger PPT workflow, this chunk by itself materially differs from the declared purpose and exposes an undeclared capability: a local review-shell prototype for annotating slides and exporting feedback payloads. Therefore this is a clear description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
There is a clear description-behavior mismatch for this code chunk. The description says the agent must run
scripts/preflight.pyon first trigger and automatically install missing Python packages, only interrupting on failure. In contrast, this script explicitly states '不会自动安装任何东西——只报告状态、给修复命令' and only checks environment state, printing remediation commands. While an environment self-check is related support functionality, the declared purpose specifically promises auto-install behavior that is absent here. Additionally, the declared filename/entrypoint ispreflight.py, but the provided implementation isdoctor.py. Finally, the declared purpose covers a large end-to-end PPT workflow, whereas this code chunk only handles environment diagnostics. That last point may be acceptable for a partial chunk, but the absent auto-install behavior is a material mismatch.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description covers a broad, multi-phase autonomous PPT production pipeline, including preflight installation, content generation, image retouching, editable PPT creation, PDF conversion, and special trigger handling. The actual code chunk only performs one supporting Phase C utility: embedding deck.json data into an editor HTML shell and adjusting background image references for local/offline use. This is related to the editable-editor portion of the description, but it does not implement the overall declared behavior and lacks most of the claimed capabilities. Therefore, the description does not accurately represent what this code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The description promises a comprehensive PPT-producing skill with multiple phases, automatic setup, PDF ingestion, retouching, and script orchestration. This code chunk does not implement those behaviors. Instead, it only post-processes existing HTML templates by replacing placeholder image sources and metadata using JSON input. While this could be a supporting helper within the larger system—specifically for Phase A preview/review UIs—the declared description does not accurately represent this code chunk’s actual purpose. The primary behavior is materially narrower and different from the declared end-to-end skill behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是一个大而全的 PPT 制作代理/工作流技能，而实际代码块只是其中很小的一部分：一个把既有 JSON 布局渲染成可编辑 PPTX 的命令行脚本。从行为上看，它不处理对话流程、环境预检、自动安装、PDF 输入、图像修复、标记触发、工作流分支控制等核心能力。虽然脚本的功能与声明中的“Phase C 一键渲染原生可编辑 PPTX”局部一致，但不足以代表整个声明的主要用途，因此属于明显的描述/行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The description claims a comprehensive self-contained PPT production skill with multiple phases, user interaction flow, PDF conversion, editable PPT generation, and marker-driven automation. The actual code chunk does none of that. It is narrowly focused on removing a corner watermark from image files via cv2.inpaint, with command-line arguments for corner, dimensions, margins, algorithm, preview, and batch mode. While the description briefly mentions image-level retouch including watermark removal, this code alone does not substantiate the declared primary purpose and instead represents a materially different standalone utility. Therefore this is a clear description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description promises a large, orchestrated PPT-production skill with multiple phases, automatic setup, image-first slide generation, optional editable reconstruction, PDF conversion, retouching, and special marker-triggered file/script execution. The supplied code does none of that. It is a focused local renderer for review markup: it loads JSON, finds existing slide images, overlays annotations, and exports marked images and note text files. This is materially different in primary purpose and capabilities. While such a script could be a supporting tool inside a PPT workflow, the description does not present the skill as merely an annotation-rendering helper, and the provided code chunk lacks the headline behaviors entirely. Therefore this is a clear description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The description promises a large, autonomous PPT production system with multiple phases, installation behavior, image manipulation, PDF conversion, and special trigger handling. The actual code chunk does none of that. It only validates the structure and values of a deck JSON file for later rendering. This is not merely a supporting implementation detail unless the description had explicitly framed this script as a validator component; instead, the declared purpose presents the skill as a complete PPT workflow. Therefore the code’s actual behavior is materially narrower and different from the declared purpose.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | Stage 2 风格预览出图后、用户做"风格确认"前 | `phaseA/previews/preview_filled.html` | `python3 scripts/inject_shell_images.py preview --shell assets/preview_shell/index.html -
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | Stage 2 风格预览出图后、用户做"风格确认"前 | `phaseA/previews/preview_filled.html` | `python3 scripts/inject_shell_images.py preview --shell assets/preview_shell/index.html -
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | Stage 2 风格预览出图后、用户做"风格确认"前 | `phaseA/previews/preview_filled.html` | `python3 scripts/inject_shell_images.py preview --shell assets/preview_shell/index.html -
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | Stage 2 风格预览出图后、用户做"风格确认"前 | `phaseA/previews/preview_filled.html` | `python3 scripts/inject_shell_images.py preview --shell assets/preview_shell/index.html -
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | Stage 2 风格预览出图后、用户做"风格确认"前 | `phaseA/previews/preview_filled.html` | `python3 scripts/inject_shell_images.py preview --shell assets/preview_shell/index.html -
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | Stage 2 风格预览出图后、用户做"风格确认"前 | `phaseA/previews/preview_filled.html` | `python3 scripts/inject_shell_images.py preview --shell assets/preview_shell/index.html -
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | Stage 2 风格预览出图后、用户做"风格确认"前 | `phaseA/previews/preview_filled.html` | `python3 scripts/inject_shell_images.py preview --shell assets/preview_shell/index.html -
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | Stage 2 风格预览出图后、用户做"风格确认"前 | `phaseA/previews/preview_filled.html` | `python3 scripts/inject_shell_images.py preview --shell assets/preview_shell/index.html -
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | Stage 2 风格预览出图后、用户做"风格确认"前 | `phaseA/previews/preview_filled.html` | `python3 scripts/inject_shell_images.py preview --shell assets/preview_shell/index.html -
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | Stage 2 风格预览出图后、用户做"风格确认"前 | `phaseA/previews/preview_filled.html` | `python3 scripts/inject_shell_images.py preview --shell assets/preview_shell/index.html -
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ew/review_filled.html` | `python3 scripts/inject_shell_images.py review --shell assets/review_shell/index.html --data phaseA/review/review_data.json --out phase
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ew/review_filled.html` | `python3 scripts/inject_shell_images.py review --shell assets/review_shell/index.html --data phaseA/review/review_data.json --out phase
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ew/review_filled.html` | `python3 scripts/inject_shell_images.py review --shell assets/review_shell/index.html --data phaseA/review/review_data.json --out phase
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ew/review_filled.html` | `python3 scripts/inject_shell_images.py review --shell assets/review_shell/index.html --data phaseA/review/review_data.json --out phase
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ew/review_filled.html` | `python3 scripts/inject_shell_images.py review --shell assets/review_shell/index.html --data phaseA/review/review_data.json --out phase
Static analysis
No suspicious patterns detected.