ClawHub
Back to skill

Security audit

pptx-extract

Security checks for vulnerabilities and agentic risk

Overview

This skill transparently extracts user-selected PowerPoint files into Markdown and assets, with disclosed handling of notes and unsupported content.

Install only if you want full-fidelity extraction. Review generated Markdown before sharing it because speaker notes and embedded slide text may contain private or internal information.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The description presents the skill primarily as an extractor/converter for PowerPoint decks, with the audit as part of proving losslessness. However, the code shown is exclusively a validation script (`audit_pptx.py`) that expects an existing `extracted/<stem>.md` and asset directory, then performs five checks against the source PPTX. It reads the source archive and output files, reports discrepancies, and exits with pass/fail status. This is a materially different primary purpose from extraction. The code does align with the '5-point machine audit' portion of the description, but the declared skill scope emphasizes end-to-end extraction and regeneration workflows that are not implemented in this chunk. Therefore the description does not accurately represent what this supplied code chunk actually does.

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding
The code substantially matches the main extraction purpose: it reads a PPTX, outputs Markdown per slide, preserves text formatting, tables, notes, hyperlinks, and extracts picture-shape images, while visibly flagging unsupported charts/OLE/vector metafiles. However, the description contains a significant additional claim that is not present in the code: there is no 5-point machine audit or proof-of-losslessness routine. The script only prints counts for slides, images, tables, notes, and charts/embeds. Also, the description says 'every ... image,' but EMF/WMF images are not extracted as assets; they are merely noted as unextractable. These differences make the description materially stronger than the implementation, so this should be flagged as a mismatch.

Hidden Instructions

High
Category
Prompt Injection
Content
## Format contract

- One Markdown file per deck: `<project>/extracted/<stem>.md`; images at `<project>/extracted/assets/<stem>/sNN-MM.<ext>` (`NN` = slide number, `MM` = picture index within the slide, document order).
- **Page delimiter:** `<!-- slide: NN -->` (zero-padded, deck order); each slide is headed `## Slide NN`.
- Deck header on line 1: `<!-- deck: <file> | slides: N | tool: extract_pptx.py -->`.
- Text: every run in document order, never summarized. Bullets nest by the paragraph indent level; emphasis is preserved; hyperlinks are carried from the slide relationships.
- Tables: real Markdown tables, multi-paragraph cells keep their line breaks via `<br>`.
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The extractor copies speaker notes verbatim into Markdown output, and notes commonly contain internal talking points, draft content, credentials, personal data, or other non-public material not visible on slides. In this skill’s context, the behavior is especially risky because the tool advertises "full-data" extraction and may be used in bulk conversion workflows, increasing the chance that sensitive notes are unintentionally exported and shared.

Static analysis

No suspicious patterns detected.