Banker Slides Pptx

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:48 AM UTC
• Version: 0.9.7

Overview

The skill is a coherent PowerPoint generator, but its renderer runs generated JavaScript and performs a mutable npm install in ways that create real local code-execution risk.

Review before installing. Use only trusted ticker/name inputs, run it in a constrained workspace, and avoid exposing credentials or unrelated files while rendering. Prefer fixing the renderer to validate ts_code, serialize JavaScript values with json.dumps, pin dependencies with a reviewed lockfile, and avoid automatic npm install during normal use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/build_outline_deck_v2.py:642

Finding

JavaScript Code Injection Through Unsanitized Ticker Input

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/build_outline_deck_v2.py:655

Finding

Unpinned Runtime npm Installation Creates a Supply-Chain Execution Risk

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The code does produce an investment-banker-style PowerPoint with real tables, bar/line charts, risk heatmaps, scenario tables, callout boxes, dividers, and cover slides, so the output type broadly matches the description. However, its primary behavior is not to turn analysis.md and data-provenance.md directly into a .pptx. Instead, it requires an existing slides-outline.md and explicitly exits if that outline is missing, indicating this script renders a deck from a structured intermediate representation rather than from the declared memo/provenance inputs. That is a material description-behavior mismatch in the skill's stated purpose. The npm install and Node compile steps are implementation details that support rendering, but the input-source discrepancy is significant enough to flag.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description says the skill turns memo inputs into a banker-quality PowerPoint deck. The supplied code chunk only prepares a prompt for another agent/process by reading a template, inserting metadata, checking prerequisite files, and embedding markdown content inline. While this may support a later .pptx-generation step, the code shown does not itself perform the described slide-generation behavior. That is a material description-versus-behavior mismatch rather than a minor implementation detail.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 217)May include surrounding context.

md

python3 scripts/build_outline_deck_v2.py <deliverable> <ts_code> <name_cn> <name_en>

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill documents file reads, file writes, and shell execution in its workflow, but it does not declare any explicit tool scope or permissions boundaries. In an agent environment, this increases the chance of over-broad tool access, accidental command execution, or misuse of filesystem operations beyond what the task strictly requires.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The schema and examples hard-code fields such as Chinese-subtitle, Chinese-title, and extensive Chinese-language content, indicating the skill expects Chinese output formatting. The file does not state that this is optional, user-selected, or justified as a region-specific skill, which can violate language/locale policy requiring user opt-in or documented rationale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The instructions require all Chinese text to be written as UTF-8 literals and prescribe a Chinese/English title structure, which imposes a specific language/locale behavior. There is no user opt-in or documented justification that this skill is intentionally restricted to a Chinese-language workflow.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This script embeds natural-language requirements such as a 'big Chinese + English subtitle section divider' and a 'Rule-3 compliant cover' with fixed English and Chinese typography rules. Similar hard-coded Chinese labels and text are used throughout the renderers, which forces a specific bilingual locale behavior rather than offering a user choice or documenting why this locale constraint is required.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The script creates the slides directory, deletes existing matching files with old.unlink(), and writes new slide JavaScript files, but there is no confirmation prompt or explicit warning that existing generated content will be removed. The file-level docstring describes rendering behavior, but does not disclose this overwrite/delete behavior to the user.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill crosses from local file transformation into external package installation and execution of Node-based compilation, materially expanding the trust boundary. In the context of an agent skill, this is more dangerous because untrusted or semi-trusted workspace content is used to generate JavaScript that is then executed, creating an avenue for arbitrary code execution if the template or generated artifacts are influenced upstream.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 88% confidence

Finding

The script performs npm install at runtime inside a generated working directory, which introduces a supply-chain and code-execution boundary not inherent to simple document rendering. Even though the package name is pinned in package.json and shell injection is not present, npm lifecycle behavior and dependency resolution can execute third-party code during installation, making this dangerous in higher-trust environments.

Content

Scanner excerpt · scripts/build_outline_deck_v2.py (reported line 672)May include surrounding context.

python

}, indent=2))

    if not (slides_dir / "node_modules" / "pptxgenjs").exists():
        r = subprocess.run(["npm", "install", "--omit=dev", "--silent"],
                           cwd=str(slides_dir), capture_output=True,
                           text=True, timeout=180)
        if r.returncode != 0:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/build_outline_deck_v2.py (reported line 678)May include surrounding context.

python

if r.returncode != 0:
            sys.exit(f"npm install failed: {r.stderr[:500]}")

    r = subprocess.run(["node", "compile.js"], cwd=str(slides_dir),
                       capture_output=True, text=True, timeout=300)
    sys.stdout.write(r.stdout)
    sys.stderr.write(r.stderr)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This markdown file instructs the agent to write slides-outline.md in the deliverable directory and then render a .pptx and run validation scripts, which are file-producing operations. The documentation does not include any warning that existing output files in the deliverable directory may be created or overwritten, so users are not explicitly alerted to potentially data-affecting behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This markdown prompt instructs the skill to write a complete outline to {deliverable_dir}/slides-outline.md and then report only the path and counts, but it does not explicitly warn the user that a file will be created or overwritten. Because markdown files should disclose behaviors that affect user data or the filesystem, this is a missing warning.

Content

No source excerpt is available for this finding.