Security audit

PPT Produce by Codex

Security checks for vulnerabilities and agentic risk

Overview

This skill is mainly a PPT-generation workflow, but it gives the agent broad access to local API configuration and external services without enough user-facing limits.

Install only if you are comfortable with the agent using your configured OpenAI-compatible API settings and sending slide prompts or images to the configured model provider. Review any command that reads shell configuration, avoid sharing credentials in chat or files, and do not use the external contact links for confidential business material.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Context-Inappropriate Capability

Low

Confidence: 98% confidence
Finding: The skill embeds self-promotional contact details and external links that are unrelated to the operational purpose of generating PPT assets. This creates an unnecessary trust boundary expansion by nudging users or agents toward off-platform resources, which can enable phishing, data exfiltration, or unreviewed social engineering paths even if no direct exploit is present in the file itself.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The guide expands a PPT/PNG production skill into building and locally running frontend demo prototypes, including use of other skills and local dev servers. That materially broadens the capability and execution surface beyond presentation generation, increasing the chance the agent writes and runs code the user did not intend to authorize under this skill.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The guide instructs reading shell environment configuration and performing direct API/model availability checks. This exceeds a pure content-production workflow and creates unnecessary access to local secrets and external network resources, which can expose credential presence and normalize secret-adjacent behavior.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The manifest description is overly broad and includes many generic activation phrases such as start, design, generate, redraw, repair, and package, which can cause the skill to trigger in contexts beyond narrowly scoped PPT production. Over-broad activation increases the chance that the agent invokes this skill on unrelated tasks, exposing project files, image workflows, or external tooling unnecessarily.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill instructs reading API-related environment configuration from ~/.zshrc, including OPENAI_API_KEY and OPENAI_BASE_URL, without any credential minimization or user warning. Accessing shell startup files can expose secrets unrelated to the current task and risks leaking credentials into logs, prompts, or downstream tools if the workflow is mishandled.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The skill is written to apply to virtually any enterprise application solution scenario, making invocation scope very broad. Overly broad scope increases the risk of the skill being used in contexts with different data sensitivity, operational expectations, or side effects than the user intended.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The guide tells the agent to use API credentials from the environment and make authenticated network calls, but provides no user-facing warning about credential handling, outbound requests, or possible disclosure of project context to third-party services. In a skill context, that omission can lead to silent secret use and privacy-impacting network behavior.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The file includes personal contact channels and encourages contacting an external author without warning users not to share sensitive project materials. This can prompt users to disclose confidential business data to an unvetted third party outside the platform's controls.

Static analysis

No suspicious patterns detected.