ppt-mcp-server

• Outcome: Review
• Latest audit: May 28, 2026 · 4:34 AM UTC
• Version: 1.0.0

Overview

This PPT skill is purpose-aligned, but it lets the agent automatically run unrestricted Python code on the user's machine.

Install only if you are comfortable with an assistant running generated Python locally. Use a sandbox, VM, or container, review the generated code before execution, restrict network and filesystem access where possible, and pin or update dependencies before relying on it.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

exec() call detected

High

• Category: Dangerous Code Execution

Content

os.chdir(OUTPUT_DIR)

        # --- 3. 执行代码 ---
        exec(processed_code, exec_globals)

        # 恢复工作目录
        os.chdir(original_cwd)

• Confidence: 99% confidence
• Finding: The tool directly executes user-supplied Python via exec(), and the provided globals expose unrestricted builtins, enabling arbitrary file access, process execution, network access, and data exfiltration. In this skill’s context, the input is expected to come from an LLM, which makes prompt-injection or malicious generated code especially dangerous because the tool’s stated purpose normalizes executing untrusted code.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The tool’s design permits arbitrary Python execution far beyond PPT-generation logic, so an attacker can perform any action available to the server process rather than only create slides. Because the skill is explicitly built to receive model-generated code, the context increases risk: a compromised prompt, malicious document, or adversarial instruction can turn the tool into a general-purpose code execution primitive.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The code comments claim a 'safe execution environment', but exec_globals includes __builtins__ unchanged, which gives executed code access to dangerous capabilities like __import__, open, eval, and system interaction. This mismatch is dangerous because it can mislead maintainers or reviewers into believing controls exist when the environment is effectively unrestricted.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill advertises automatic generation and execution of Python code to create PPT files, but does not warn that it is executing model-authored code or writing files to disk. Because the core design is 'generate code and directly execute,' missing disclosure and consent around execution and file creation makes accidental or unsafe operations much more likely.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The example triggers are ordinary natural-language requests for making a presentation, which are broad enough to cause unintended activation in normal conversation. In a skill that can execute generated code, accidental invocation is more dangerous than in a read-only or purely advisory skill because it may lead directly to code execution and file creation.

Missing User Warnings

High

• Confidence: 90% confidence
• Finding: The tool executes supplied Python code without a clear user-facing warning that it is effectively arbitrary code execution, creating unsafe expectations and increasing the chance that operators will pass untrusted model output into it. In an agent/tooling environment, poor disclosure materially increases exploitation likelihood because users may assume the tool is limited to PPT generation when it is not.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

mcp>=1.6.0
python-pptx>=0.6.21

• Confidence: 93% confidence
• Finding: The dependency is specified with a lower bound only (`mcp>=1.6.0`), which allows future major or minor releases to be installed without review. That creates supply-chain risk because a newly released version could introduce breaking behavior or a vulnerable release into the build unexpectedly.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

mcp>=1.6.0
python-pptx>=0.6.21

• Confidence: 88% confidence
• Finding: `python-pptx>=0.6.21` is also unpinned, so installations may resolve to different versions over time. This weakens reproducibility and can pull in unintended package updates, increasing supply-chain and stability risk even if no specific vulnerable version is identified here.

Known Vulnerable Dependency: mcp — 3 advisory(ies): CVE-2025-53366 (MCP Python SDK vulnerability in the FastMCP Server causes validation error, lead); CVE-2025-66416 (Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection); CVE-2025-53365 (MCP Python SDK has Unhandled Exception in Streamable HTTP Transport, Leading to )

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: The requirement allows installation of `mcp` versions affected by multiple disclosed advisories, because `>=1.6.0` does not exclude vulnerable releases. In a skill that exposes MCP functionality, weaknesses such as missing DNS rebinding protection or transport/validation handling flaws can materially increase exposure, especially if the service is network-accessible.

Static analysis

No suspicious patterns detected.