PowerPoint

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:42 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent for local PowerPoint automation, but it asks for persistent agent routing and includes an unsafe export command pattern.

Install only if you are comfortable granting the agent local PowerPoint automation ability. Avoid adding persistent workspace or AGENTS routing rules unless you approve the exact text and destination, and do not use the PDF export example with untrusted filenames until the path handling is hardened.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

• Location: setup.md:38
• Finding: Persistent Agent Routing Rule Written to Workspace Memory## Vulnerability Details **File Location**: `setup.md`, lines 38-40 **Vulnerability Type**: Persistent modification of Agent memory or guidance **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ### 4. Register the skill in workspace memory Add a short note to your workspace memory or AGENTS guidance saying that PowerPoint Desktop tasks should route to `powerpoint` when the job depends on the live app session. ``` ### Technical Analysis The setup procedure instructs the Agent to modify persistent workspace memory or an `AGENTS` guidance file. Such files can influence task routing and Agent behavior after the current Skill invocation has ended. This behavior crosses the boundary between configuring the Skill and modifying long-term Agent instructions. The requested persistent rule is authored by the Skill and may be installed without identifying the exact destination file, presenting the proposed change to the user, or obtaining explicit approval for that persistent modification. Although the proposed rule is limited to PowerPoint task routing and does not override explicit safety controls, modifying persistent Agent guidance is unnecessary for performing the advertised live PowerPoint automation. ### Attack Path 1. The Agent loads the Skill and follows its first-time setup procedure. 2. The setup procedure directs the Agent to locate workspace memory or an `AGENTS` guidance file. 3. The Agent writes the Skill-provided routing rule into that persistent file. 4. The rule remains present after the current task and session end. 5. Future PowerPoint-related requests are routed to this Skill because of the stored instruction, even when the user did not explicitly select it for those later tasks. ### Impact Assessment The modification affects persistent Agent routing within the scope of the workspace or memory system that receives the rule. It may cause future tasks to select this Skill automatically and in ...[truncated 316 chars]
• Remediation: ## Remediation Suggestions 1. Remove the instruction to modify workspace memory or `AGENTS` guidance during routine setup. 2. Keep task-routing metadata in the Skill manifest or another non-persistent Skill registration mechanism. 3. If persistent routing is genuinely required, require explicit user approval before making the change. 4. Identify the exact destination file and show the precise proposed addition before writing it. 5. Limit the rule to the narrowest relevant workspace and document how the user can remove it. 6. Do not allow the Skill to overwrite or broadly rewrite existing Agent guidance.

T09 · Insecure Skill Coding Practices

Warning

• Location: live-control-patterns.md:31
• Finding: AppleScript and Shell Injection Through Unescaped Export Path Substitution## Vulnerability Details **File Location**: `live-control-patterns.md`, lines 31-35 **Vulnerability Type**: Unsafe interpolation of a file path into executable source **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ## 3. Export the live deck to PDF ```bash osascript -e 'tell application "Microsoft PowerPoint" to save active presentation in "/absolute/path/to/output.pdf" as save as PDF' ``` ``` ### Technical Analysis The documented command places the export path directly inside AppleScript source, which is itself enclosed in shell quoting. An Agent following this template is expected to replace `/absolute/path/to/output.pdf` with the requested destination. If that substitution is performed as direct string interpolation, an attacker-controlled path containing an AppleScript double quote can terminate the AppleScript string and introduce additional AppleScript statements. A path containing a shell single quote can also terminate the outer shell-quoted argument if the command is constructed as shell text. Shell quoting around the entire AppleScript expression does not safely encode the path for AppleScript. Safe handling requires keeping data values separate from executable source and passing the destination through `argv` or another structured parameter mechanism. ### Attack Path 1. An attacker supplies or influences the requested PDF export filename or destination path. 2. The path contains characters that terminate the AppleScript string or the surrounding shell argument. 3. The Agent replaces the placeholder in the documented command without language-specific escaping. 4. `osascript` parses the injected text as AppleScript rather than as part of the destination path. 5. The injected AppleScript can perform additional PowerPoint operations or invoke other local commands under the Agent's user account. 6. The resulting command executes when the Agent attempts to export the presentation. Exploita ...[truncated 730 chars]
• Remediation: ## Remediation Suggestions Pass the destination path as a positional argument rather than embedding it into AppleScript source: ```bash output_path="/absolute/path/to/output.pdf" osascript - "$output_path" <<'APPLESCRIPT' on run argv set outputPath to item 1 of argv tell application "Microsoft PowerPoint" save active presentation in outputPath as save as PDF end tell end run APPLESCRIPT ``` Additional hardening should include: 1. Resolve the destination to an absolute path before invoking PowerPoint. 2. Verify that the parent directory exists and is an approved export location. 3. Reject control characters, including newlines and null bytes, in externally supplied filenames. 4. Check for an existing destination and request confirmation before overwriting it. 5. Avoid constructing shell commands through string concatenation. 6. After export, verify that the expected file exists at the exact approved destination.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.