ppt pro

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:49 AM UTC
• Version: 9.7.0

Overview

This PPT-generation skill is purpose-aligned, but its local conversion tooling has unsafe execution, file-reading, browser, and dependency-installation behaviors that deserve review before use.

Install only if you are comfortable running local Python/Node conversion scripts and browser automation. Use it in a dedicated workspace or container, avoid converting untrusted HTML or documents, review generated slide HTML before packaging, and do not follow the optional WPS sudo installation steps unless you can verify the package source and hash.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/html2pptx.js:70

Finding

Shell Command Injection Through User-Controlled Conversion Paths

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/html_packager.py:21

Finding

Arbitrary Local File Disclosure Through Preview Asset Inlining

Content

View full analysis

str: def replace_src(match): attr = match.group(1) path_str = match.group(2) closing = match.group(3) img_path = Path(path_str) if not img_path.is_absolute(): img_path = html_dir / path_str if img_path.exists() and img_path.is_file(): ext = img_path.suffix.lower().lstrip('.') mime = {'jpg': 'image/jpeg', 'jpeg': 'image/jpeg', 'png': 'image/png', 'gif': 'image/gif', 'svg': 'image/svg+xml', 'webp': 'image/webp' }.get(ext, f'image/{ext}') data = base64.b64encode(img_path.read_bytes()).decode() return f'{attr}data:{mime};base64,{data}{closing}' return match.group(0) ``` ### Technical Analysis The Base64 operation is intended to produce a self-contained HTML preview and is not itself covert network exfiltration or decode-and-execute behavior. The vulnerability is the absence of a filesystem boundary before `read_bytes()`. The code accepts: - Absolute paths. - Relative paths containing `../`. - Symlinks that resolve outside the slide asset directory. - Existing files with extensions outside the intended image allowlist. Any matching `src` or CSS `url()` value is resolved and read if it points to a regular file. The resulting bytes are embedded in `preview.html` as a data URI. A sensitive file can therefore become part of an ordinary presentation deliverable. Reading assets is necessary for portable preview generation, but reading arbitrary files outside an explicitly approved asset directory exceeds the minimum privileges required. ### Attack Path 1. Attacker-influenced slide HTML includes an absolute ...[truncated 1076 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/extract_slides.js:56

Finding

Untrusted HTML Executes With JavaScript, Network Access, and Disabled Chromium Sandbox

Content

View full analysis

Remediation

View remediation

{ const protocol = new URL(request.url()).protocol; if (protocol === "data:" || protocol === "file:") { request.continue(); } else { request.abort(); } }); ``` 3. Sanitize HTML before rendering. Remove: - Script elements. - Event-handler attributes. - Embedded frames and objects. - JavaScript URLs. - Remote stylesheets, fonts, and media. - Unexpected navigation and form elements. 4. Apply a restrictive Content Security Policy, such as an offline policy that denies all network destinations. 5. Remove `--no-sandbox` and `--disable-setuid-sandbox` where the host supports normal Chromium sandboxing. 6. If sandbox disabling is unavoidable, run conversion in an ephemeral container or dedicated low-privilege account with: - No secrets mounted. - No home-directory access. - Read-only input. - A dedicated output directory. - No network access. - CPU, memory, process, and execution-time limits. 7. Apply the same controls consistently to Puppeteer and Playwright backends. ]]>

T08 · Insecure Dependencies

Warning

• Location: scripts/html2png.py:128

Finding

Runtime Installation of Unpinned Third-Party Dependencies

Content

View full analysis

bool: if not _check_puppeteer(work_dir): print("Installing puppeteer...") try: r = subprocess.run( ["npm", "install", "puppeteer"], capture_output=True, text=True, timeout=180, cwd=str(work_dir) ) if r.returncode != 0: return False except (subprocess.TimeoutExpired, FileNotFoundError): return False ``` The Python manifest permits any later compatible versions rather than exact reviewed versions: ```toml dependencies = [ "python-pptx>=0.6.21", "Pillow>=9.0", "lxml>=4.0", "fonttools>=4.0", ] [project.optional-dependencies] playwright = ["playwright>=1.30"] ``` The setup script also installs unpinned Python packages at runtime: ```bash pip install python-pptx Pillow lxml fonttools 2>/dev/null ``` ### Technical Analysis If Puppeteer is unavailable, `html2png.py` automatically executes `npm install puppeteer` in a dynamically selected working directory. No exact version is requested, and that directory may not contain the reviewed project lockfile. The Python dependencies use open-ended minimum versions and are also installed without hashes. This makes the effective code executed by the Skill dependent on the package registry state at installation time. Package installation can execute build hooks, native compilation, or npm lifecycle scripts. Consequently, a compromised package release, dependency, registry, or local package configuration can introduce code that was not present during the Skill a ...[truncated 1381 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: WPS_TESTING.md:23

Finding

Privileged Installation Guidance for an Unverified Community-Hosted WPS Package

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (109)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Editing local application configuration files, automating office software, or converting local documents are materially sensitive actions that must be plainly disclosed. If those behaviors exist behind an innocuous 'make me a PPT' skill description, the risk is higher because the skill could alter the user's environment or process private documents without informed consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

Editing local application configuration files, automating office software, or converting local documents are materially sensitive actions that must be plainly disclosed. If those behaviors exist behind an innocuous 'make me a PPT' skill description, the risk is higher because the skill could alter the user's environment or process private documents without informed consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Editing local application configuration files, automating office software, or converting local documents are materially sensitive actions that must be plainly disclosed. If those behaviors exist behind an innocuous 'make me a PPT' skill description, the risk is higher because the skill could alter the user's environment or process private documents without informed consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

Editing local application configuration files, automating office software, or converting local documents are materially sensitive actions that must be plainly disclosed. If those behaviors exist behind an innocuous 'make me a PPT' skill description, the risk is higher because the skill could alter the user's environment or process private documents without informed consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Editing local application configuration files, automating office software, or converting local documents are materially sensitive actions that must be plainly disclosed. If those behaviors exist behind an innocuous 'make me a PPT' skill description, the risk is higher because the skill could alter the user's environment or process private documents without informed consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Editing local application configuration files, automating office software, or converting local documents are materially sensitive actions that must be plainly disclosed. If those behaviors exist behind an innocuous 'make me a PPT' skill description, the risk is higher because the skill could alter the user's environment or process private documents without informed consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

Editing local application configuration files, automating office software, or converting local documents are materially sensitive actions that must be plainly disclosed. If those behaviors exist behind an innocuous 'make me a PPT' skill description, the risk is higher because the skill could alter the user's environment or process private documents without informed consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Editing local application configuration files, automating office software, or converting local documents are materially sensitive actions that must be plainly disclosed. If those behaviors exist behind an innocuous 'make me a PPT' skill description, the risk is higher because the skill could alter the user's environment or process private documents without informed consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Editing local application configuration files, automating office software, or converting local documents are materially sensitive actions that must be plainly disclosed. If those behaviors exist behind an innocuous 'make me a PPT' skill description, the risk is higher because the skill could alter the user's environment or process private documents without informed consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Editing local application configuration files, automating office software, or converting local documents are materially sensitive actions that must be plainly disclosed. If those behaviors exist behind an innocuous 'make me a PPT' skill description, the risk is higher because the skill could alter the user's environment or process private documents without informed consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Editing local application configuration files, automating office software, or converting local documents are materially sensitive actions that must be plainly disclosed. If those behaviors exist behind an innocuous 'make me a PPT' skill description, the risk is higher because the skill could alter the user's environment or process private documents without informed consent.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 366)May include surrounding context.

md

| `scripts/extract_slides.js` | Step 6 B | Phase 1 |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The code uses subprocess.call(f"kill -9 {pid}", shell=True), combining shell execution with string interpolation. If pid is ever influenced unexpectedly or returned in an unsafe form, this creates a command-injection primitive; additionally, SIGKILL prevents graceful cleanup and can terminate the wrong process if process identification is mishandled. In this skill context, the snippet is presented as reusable automation guidance, which makes unsafe process handling more dangerous because users may copy it into production scripts.

Content

Scanner excerpt · WPS_TESTING.md (reported line 103)May include surrounding context.

6. 退出时用 kill -9 PID（app.Quit 不可靠）

import subprocess subprocess.call(f"kill -9 {pid}", shell=True)

text

> **关键教训**: 之前的版本手动启动 `wpp` 进程再尝试 `createWppRpcInstance`，

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/prompts/prompt-4-design.md (reported line 497)May include surrounding context.

html

<div class="insight-bar">
  <div class="insight-icon"><!-- 内联 SVG 图标 --></div>
  <p class="insight-text"><strong>趋势判断：</strong>一句话核心洞察...</p>
</div>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/prompts/prompt-4-design.md (reported line 497)May include surrounding context.

html

<div class="insight-bar">
  <div class="insight-icon"><!-- 内联 SVG 图标 --></div>
  <p class="insight-text"><strong>趋势判断:</strong>一句话核心洞察...</p>
</div>

Known Vulnerable Dependency: basic-ftp==5.2.0 — 4 advisory(ies): GHSA-6v7q-wjvx-w8wg (basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Exe); CVE-2026-39983 (basic-ftp has FTP Command Injection via CRLF); CVE-2026-41324 (basic-ftp vulnerable to denial of service via unbounded memory consumption in Cl) +1 more

High

• Category: Supply Chain
• Confidence: 85% confidence

Finding

The lockfile pins basic-ftp 5.2.0, and the reported advisories indicate FTP command injection and denial-of-service weaknesses. Although this package is only transitive here via Puppeteer's proxy/PAC stack, shipping a known-vulnerable version is still a real supply-chain risk if any workflow enables attacker-influenced FTP/PAC URI handling.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: extract-zip==2.0.1 — 2 advisory(ies): CVE-2026-19693 (extract-zip allows arbitrary file writes through symlink archive entries); CVE-2026-56876 (extract-zip unvalidated symlink path traversal)

High

• Category: Supply Chain
• Confidence: 92% confidence

Finding

extract-zip 2.0.1 is a real concern because archive extraction bugs involving symlinks can lead to arbitrary file write or path traversal during unzip operations. In this dependency graph it is pulled in by @puppeteer/browsers, which may extract downloaded browser archives during install/runtime, making the PPT-generation skill's browser automation context more exposed than a passive library-only use case.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ip-address==10.1.0 — 2 advisory(ies): CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco); CVE-2026-42338 (ip-address has XSS in Address6 HTML-emitting methods)

High

• Category: Supply Chain
• Confidence: 81% confidence

Finding

ip-address 10.1.0 is present with reported parsing and HTML-emission issues. In this lockfile it is transitive through socks/socks-proxy-agent/proxy-agent, so exploitability depends on whether the skill processes attacker-controlled proxy configuration or renders Address6 HTML output, which is not evident from the lockfile alone.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: js-yaml==4.1.1 — 4 advisory(ies): CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption); GHSA-5p4m-2wfm-xmqj (JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026) +1 more

High

• Category: Supply Chain
• Confidence: 87% confidence

Finding

js-yaml 4.1.1 has reported CPU-exhaustion issues from crafted YAML structures, so keeping this exact vulnerable version is a genuine denial-of-service risk. Here it is transitive via cosmiconfig used by Puppeteer, and becomes more dangerous if the skill or its environment loads YAML-based configuration from untrusted or user-influenced sources.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.20.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 84% confidence

Finding

ws 8.20.0 is a real issue because the advisories describe memory disclosure and memory-exhaustion conditions in WebSocket handling. Since Puppeteer relies on ws for browser protocol communication, a PPT-generation skill that automates Chromium may expose this path in local or remote browser-control scenarios, increasing risk beyond a dormant dependency.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 92% confidence

Finding

This is a tool/process-control abuse pattern because the skill gains the ability to issue a shell-based hard kill against a local process. In the context of a PPT-generation skill, that capability is broader than necessary and can be leveraged to disrupt the host system; the use of shell=True further weakens the safety boundary around the parameter.

Content

Scanner excerpt · scripts/wps_convert.py (reported line 178)May include surrounding context.

python

except Exception:
            pass
        if wps_pid is not None:  # E4: kill by PID for reliable cleanup
            subprocess.call(f"kill -9 {wps_pid}", shell=True)


if __name__ == "__main__":

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill declares extensive capabilities involving shell execution, file reads/writes, environment inspection, package installation, and script execution, but does not define any explicit tool scope or allowed-tools boundary. This increases the chance of over-privileged execution and makes it harder for the host platform or user to understand and constrain what the skill may do on the local system.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are very broad and include common everyday requests like making slides, decks, courseware, or converting documents to PPT. Because this skill can run shell commands, create files, and install dependencies, over-broad activation increases the chance of accidental invocation in contexts where the user did not intend to authorize those operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs the agent to create directories, write output files, run shell commands, and install Python/Node packages, but the description does not prominently warn users about these side effects. Lack of disclosure is dangerous because users may unknowingly allow local system modification and dependency installation while expecting only content-generation assistance.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · WPS_TESTING.md (reported line 33)May include surrounding context.

bash

# 1. 安装 WPS
sudo dpkg -i wps-office_11.1.0.11719_amd64.deb
sudo apt --fix-broken install -y  # 修复可能的依赖

# 2. 安装 pywpsrpc + Qt5 依赖

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/html2pptx.js:70