other
Warning
- Location
README.md:207- Finding
Misleading Privacy Claim Despite Third-Party Document Submission
- Content
View full analysis
Vulnerability Details
File Location:
README.md:207-212, with the contradictory upload workflow documented inSKILL.md:108-133
Vulnerability Type: Misleading privacy disclosure
Risk Level: MediumVulnerable Code Snippets
Privacy statement in
README.md:207-212:markdown ## 🔐 安全说明 - ❌ **不嵌入**任何第三方 API Key - ✅ API Key 由用户在配置阶段自行输入 - ✅ 仅保存在用户本地配置中 - ✅ 不会上传到任何第三方服务器Contradictory third-party submission workflow in
SKILL.md:108-133:markdown #### 方案 A：anygen（推荐） ```bash # 1. 准备任务 anygen task prepare --data '{"operation":"slide","messages":[{"role":"user","content":{"text":"[PPT需求]"}}]}' # 2. 从响应获取 suggested_task_params，创建任务 anygen task create --data '{"operation":"slide","prompt":"[final_prompt]"}' # 3. 轮询等待完成（可能需要几分钟） anygen task get --params '{"task_id":"<id>"}' --wait --timeout 600000 # 4. 下载 anygen task +download --task-id <id> --output-dir /tmp/academic-ppt/方案 B：gamma.app
bash # 使用 gamma API（需用户提供 API Key） curl -X POST https://api.gamma.app/v1/presentations \ -H "Authorization: Bearer $GAMMA_API_KEY" \ -H "Content-Type: application/json" \ -d '{"title":"[Doc_Title]","slides":[...]}'text ### Technical Analysis The README explicitly claims that data will not be uploaded to any third-party server. However, the prescribed presentation-generation workflow sends paper-derived information to Anygen or Gamma. The submitted data includes the presentation requirements or final prompt and, for Gamma, the document title and slide content. Use of an external presentation service is part of the advertised functionality and is not inherently malicious. The security problem is the inaccurate privacy representation: users may provide confidential material believing it remains local when the workflow necessarily discloses derived content to an external provider. This finding is limited to misleading disclosure. The audited package co ...[truncated 1420 chars]- Remediation
View remediation
Remediation Suggestions
- Remove the assertion that content is never uploaded to third-party servers.
- Clearly state that selecting Anygen or Gamma transmits paper-derived prompts, titles, slide outlines, and presentation content to that provider.
- Request explicit user confirmation immediately before each external submission, showing the provider and categories of data to be sent.
- Make
skipthe default provider for documents classified as confidential, unpublished, embargoed, or sensitive. - Provide a local-only workflow that generates translation, summary, outline, and speech-note files without invoking an external presentation service.
- Link to each provider's privacy, retention, training-use, and deletion policies so users can make an informed decision.
- Minimize transmitted data by removing unnecessary identifiers and sending only the content required for slide generation.
- Update
README.md,SKILL.md, and package metadata so all privacy disclosures consistently describe both third-party PPT submission and subsequent WeChat delivery.