ClawHub
Back to skill

Security audit

ppt-mcp-server

Security checks across malware telemetry and agentic risk

Overview

This PPT skill is purpose-aligned, but it lets the agent automatically run unrestricted Python code on the user's machine.

Install only if you are comfortable with an assistant running generated Python locally. Use a sandbox, VM, or container, review the generated code before execution, restrict network and filesystem access where possible, and pin or update dependencies before relying on it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (9)

exec() call detected

High
Category
Dangerous Code Execution
Content
os.chdir(OUTPUT_DIR)

        # --- 3. 执行代码 ---
        exec(processed_code, exec_globals)

        # 恢复工作目录
        os.chdir(original_cwd)
Confidence
99% confidence
Finding
exec(processed_code, exec_globals)

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The tool’s design permits arbitrary Python execution far beyond PPT-generation logic, so an attacker can perform any action available to the server process rather than only create slides. Because the skill is explicitly built to receive model-generated code, the context increases risk: a compromised prompt, malicious document, or adversarial instruction can turn the tool into a general-purpose code execution primitive.

Intent-Code Divergence

High
Confidence
97% confidence
Finding
The code comments claim a 'safe execution environment', but exec_globals includes __builtins__ unchanged, which gives executed code access to dangerous capabilities like __import__, open, eval, and system interaction. This mismatch is dangerous because it can mislead maintainers or reviewers into believing controls exist when the environment is effectively unrestricted.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill advertises automatic generation and execution of Python code to create PPT files, but does not warn that it is executing model-authored code or writing files to disk. Because the core design is 'generate code and directly execute,' missing disclosure and consent around execution and file creation makes accidental or unsafe operations much more likely.

Vague Triggers

Medium
Confidence
83% confidence
Finding
The example triggers are ordinary natural-language requests for making a presentation, which are broad enough to cause unintended activation in normal conversation. In a skill that can execute generated code, accidental invocation is more dangerous than in a read-only or purely advisory skill because it may lead directly to code execution and file creation.

Missing User Warnings

High
Confidence
90% confidence
Finding
The tool executes supplied Python code without a clear user-facing warning that it is effectively arbitrary code execution, creating unsafe expectations and increasing the chance that operators will pass untrusted model output into it. In an agent/tooling environment, poor disclosure materially increases exploitation likelihood because users may assume the tool is limited to PPT generation when it is not.

Unpinned Dependencies

Low
Category
Supply Chain
Content
mcp>=1.6.0
python-pptx>=0.6.21
Confidence
93% confidence
Finding
mcp>=1.6.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
mcp>=1.6.0
python-pptx>=0.6.21
Confidence
88% confidence
Finding
python-pptx>=0.6.21

Known Vulnerable Dependency: mcp — 3 advisory(ies): CVE-2025-53366 (MCP Python SDK vulnerability in the FastMCP Server causes validation error, lead); CVE-2025-66416 (Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection); CVE-2025-53365 (MCP Python SDK has Unhandled Exception in Streamable HTTP Transport, Leading to )

High
Category
Supply Chain
Confidence
97% confidence
Finding
mcp

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.