ppt-craft-editable

• Outcome: Review
• Latest audit: Jul 9, 2026 · 10:20 AM UTC
• Version: 0.1.5

Overview

This PPT skill appears purpose-built, but it gives the agent too much automatic authority to install software and act on pasted instruction blocks without clear user control.

Install only if you are comfortable with a PPT skill that can run local Python scripts, install packages, open local browser pages, process slide/PDF content with AI/image tooling, and store temporary review data locally. Before using it, require manual confirmation for package installs and IOPaint setup, avoid confidential PDFs unless you accept external model processing, and do not paste sentinel blocks from untrusted sources.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (29)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 试常规
    try:
        proc = subprocess.run(
            base_cmd + [pkg_name],
            timeout=600,   # 单包最多 10 分钟（OpenCV 在国内网络下可能 5+ 分钟）
            capture_output=True,

• Confidence: 93% confidence
• Finding: proc = subprocess.run( base_cmd + [pkg_name], timeout=600, # 单包最多 10 分钟（OpenCV 在国内网络下可能 5+ 分钟） capture_output=True, text=True, )

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# fallback：--user
    try:
        proc2 = subprocess.run(
            [sys.executable, "-m", "pip", "install", "--user", "--upgrade",
             "--disable-pip-version-check", "--quiet", pkg_name],
            timeout=600,

• Confidence: 92% confidence
• Finding: proc2 = subprocess.run( [sys.executable, "-m", "pip", "install", "--user", "--upgrade", "--disable-pip-version-check", "--quiet", pkg_name], timeout=600,

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 98% confidence
• Finding: The skill describes broad operational capabilities including shell execution, file reads/writes, network access, and package installation, but declares no explicit permissions boundary. That creates a confused-deputy risk where a user may invoke a seemingly content-generation skill that can silently modify the environment and execute scripts. In this context, the lack of declared permissions is especially dangerous because the skill explicitly directs automatic command execution and package installation.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The renderer accepts background references as absolute filesystem paths and file:// URLs, then passes them directly into image-loading routines. In this skill, deck/layout JSON can be produced from user-controlled content and the broader workflow explicitly instructs the agent to write marked JSON verbatim and run scripts, so an attacker could cause the agent to read arbitrary local files outside the project directory, creating a local file disclosure and boundary-bypass risk.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: This script explicitly provides watermark removal, including guidance for removing AI-tool watermarks, which is a sensitive image-manipulation capability that extends beyond ordinary PPT generation. In this skill context, the broader manifest also advertises watermark removal and automatic tool installation, which increases misuse risk because the agent can operationalize content laundering or rights circumvention rather than just formatting slides.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The skill advertises trigger phrases that are very broad, such as generic requests to make a PPT from a topic or rough materials. In agent environments where skills are auto-selected from natural language, this can cause the skill to activate on ordinary conversation and then perform side effects like running preflight checks or installing packages without sufficiently explicit user intent.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The PDF-conversion invocation is described in a permissive, natural-language way without strong constraints on when the branch should activate. Because this workflow processes uploaded files and leads to automated extraction and downstream script execution, ambiguous triggering increases the chance of unintended handling of PDFs and accidental execution of a more privileged workflow than the user expected.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The activation scope is broad enough to trigger on ordinary PPT-related requests, increasing the chance that users unintentionally invoke a skill that runs shell commands, writes files, and may install packages. Overbroad auto-selection is dangerous here because this skill is not passive content guidance; it has side effects on the host environment.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The skill instructs the agent to automatically perform environment checks and install missing Python packages on first use without upfront user warning at activation time. Silent dependency installation is a high-risk action because it changes the local environment, consumes network and disk resources, and may execute unreviewed package-install workflows under the user's account.

Missing User Warnings

Medium

• Confidence: 100% confidence
• Finding: Stage 0 explicitly says to 'directly silently run' a shell command that can install packages. This is dangerous because it normalizes undisclosed execution of environment-modifying commands and bypasses the user's opportunity to review or deny system changes before they happen.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The progressive loading section reinforces a pattern of silently running preflight on first trigger. Repetition of this instruction makes the unsafe behavior part of the intended control flow, increasing the likelihood of undisclosed package installation and shell execution during routine use.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The page comments, notes, and markup data are automatically persisted to browser localStorage, which is long-lived and readable by any script running on the same origin. In this skill context, review content may include confidential slide content, critique, or sensitive business/research material, so silent persistence increases the risk of unintended disclosure on shared machines or if the hosting origin is later compromised by XSS.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The app copies the full review payload to the system clipboard without a clear warning about what leaves the app boundary. Clipboard contents can be accessed or overwritten by other local applications and may later be pasted into the wrong destination, which is especially risky here because the payload can contain structured comments and annotations about potentially sensitive PPT material.

Missing User Warnings

Low

• Confidence: 94% confidence
• Finding: The workflow requires automatically opening a local HTML preview page as a default action, which can surprise users and trigger unintended local-file or browser launches without explicit consent. In an agent skill that may process untrusted generated content, auto-launching local interfaces increases the chance of exposing users to confusing or unsafe UI behavior, even if the page is locally generated.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The instructions explicitly tell users to save retouched output and even suggest overwriting the original image, but they do not require backup creation or warn that inpainting/removal is destructive and may irreversibly degrade source assets. In a PPT production workflow, losing the pristine slide renders can make later review, re-editing, or forensic comparison impossible.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document normalizes automatic installation of IOPaint, Python packages, models, venv creation, and cache writes without a strong upfront consent prompt, despite substantial system changes and multi-GB downloads. In an agent skill context, this is more dangerous because the metadata also directs the agent to auto-install missing packages silently, which can surprise users, consume resources, and expand the local attack surface.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The design explicitly routes uploaded PDF page images and extracted slide content through multimodal and image-generation systems, but it does not require any user-facing notice, consent, or data-handling constraints. Because PDFs often contain confidential business, legal, financial, or personal data, silent transmission to external AI services can cause unintended disclosure and compliance violations, especially in an automated workflow that triggers processing by default.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The pipeline instructs the agent to silently run a preflight step that can automatically install missing Python packages before notifying the user. Silent dependency installation changes the local environment and can pull unreviewed code from package registries, creating supply-chain and consent risks, especially when triggered automatically on first use.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This section operationalizes watermark removal and automatic setup of an external retouch tool without a clear warning, approval gate, or policy boundary. Combining auto-installation with image-manipulation tooling increases the chance of unauthorized environment changes and misuse for provenance removal.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The skill tells the agent to treat user-pasted sentinel blocks as authoritative and write enclosed JSON verbatim to files, then run downstream scripts without interpretation. This is a classic unsafe deserialization/trust-boundary problem: untrusted chat content is being elevated into executable workflow input and persisted as the source of truth, enabling malicious payloads, path references, resource exhaustion, or abuse of downstream parsers/renderers.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: The Phase C workflow directs the agent to overwrite phaseC/deck.json with user-pasted data and render it directly into a PPTX. In this skill context, that is particularly risky because the downstream renderer accepts file paths and other rich fields, so a crafted deck can trigger unintended local file access, broken output generation, or denial-of-service via oversized/complex content.

Ssd 3

Medium

• Confidence: 99% confidence
• Finding: The fallback behavior is even riskier because it accepts bare JSON without sentinel framing and still saves and renders it. That removes even the minimal structural cue intended to distinguish editor exports from arbitrary chat content, making accidental or malicious injection substantially easier.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: Phase D similarly instructs the agent to write confirmed extraction JSON verbatim and use it downstream without interpretation or modification. Because this JSON drives background generation and deck construction, untrusted content can manipulate file creation and renderer inputs, again crossing from chat text into high-trust workflow state without validation.

Ssd 1

High

• Confidence: 98% confidence
• Finding: The export function deliberately generates a copy-paste instruction block that tells an AI agent to 'not interpret' JSON and to write files and run scripts based on embedded markers. This is effectively prompt-injection-by-design: untrusted editor content is packaged with workflow commands intended to coerce downstream automation into blindly performing file writes and script execution.

Ssd 4

Medium

• Confidence: 96% confidence
• Finding: The UI explicitly trains the user to copy a full marked instruction block back into an AI chat and emphasizes that the agent will know to save and render on seeing the markers. That normalization increases the likelihood of successful indirect prompt injection and unsafe automation, especially when combined with the sentinel-driven execution model elsewhere in the skill.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.