AI Presentation Maker

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:33 PM UTC
• Version: 1.0.0

Overview

This appears to be a legitimate presentation-making skill, but it has review-worthy security issues around reading persona files outside its stated scope and unsafe HTML export handling.

Install only after reviewing the scope. Use the Persona OS import only if you explicitly want the skill to read SOUL.md or AGENTS.md, avoid exporting untrusted or third-party Markdown to HTML until sanitization is fixed, and install optional Python dependencies only in an isolated, pinned environment.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:82

Finding

Agent identity files are accessed outside the declared workspace scope

Content

View full analysis

/dev/null | wc -l ``` The subsequent instruction explicitly directs the Agent to read these files: ```markdown > **AGENT: If AI Persona OS is detected**, pull speaker info from SOUL.md or AGENTS.md if available. Ask user to confirm. ``` ### Technical Analysis The Skill declares that file operations are limited to `~/workspace/presentations/`, but its post-install procedure probes files under `~/workspace/`, and its setup instructions direct the Agent to extract information from `SOUL.md` or `AGENTS.md`. These files may contain Agent identity, behavioral configuration, private profile details, or other persistent context unrelated to presentation generation. The instruction to ask the user to confirm occurs after the information has already been pulled, rather than before access. This violates least-privilege and contradicts the Skill's stated boundary: ```markdown **Scope: ~/workspace/presentations/ only.** ``` ### Attack Path 1. The user loads the Skill. 2. The mandatory post-install check probes `~/workspace/SOUL.md` and `~/workspace/AGENTS.md`. 3. If either file exists, the Skill instructs the Agent to read it. 4. Identity or configuration details are extracted before the user grants permission. 5. The extracted data may be placed into presentation metadata, slide content, or speaker information. ### Impact Assessment The Skill can obtain read access to identity and configuration information outside its declared storage directory. The practical scope is limited to files readable by the current Agent process, but the exposed information may include persistent profile details or confidential Agent instructions. No operating-system privilege escalation was identif ...[truncated 132 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/export-html-slides.py:137

Finding

Unescaped Markdown content enables stored script injection in exported HTML

Content

View full analysis

'): text = apply_inline(stripped.lstrip('> ')) html_parts.append(f'

{text}

') continue # Regular paragraph text = apply_inline(stripped) html_parts.append(f'

{text}

') ``` The inline formatter also inserts Markdown links directly into HTML attributes: ```python def apply_inline(text: str) -> str: """Apply inline markdown formatting.""" # Bold text = re.sub(r'\*\*([^*]+)\*\*', r'\1', text) # Italic text = re.sub(r'\*([^*]+)\*', r'\1', text) # Code text = re.sub(r'`([^`]+)`', r'\1', text) # Links text = re.sub(r'\[([^\]]+)\]\(([^)]+)\)', r'\1', text) return text ``` ### Technical Analysis Deck content originates from interview responses and presentation Markdown, both of which can contain attacker-controlled text. Ordinary paragraphs, list items, blockquotes, link labels, and link destinations are passed to `apply_inline()` without first being HTML-escaped. Because `apply_inline()` uses regular-expression substitutions rather than a sanitizing Markdown parser, raw HTML remains executable. For example, content such as: ```html ``` is inserted directly into the exported presentation. Markdown links are also converted without validating their scheme: ```markdown [Open resource](javascript:alert(document.domain)) ``` This becomes: ```html Open resource ``` The resulting payload executes when the exported deck is opened or when the malicious link is selected. This is a stored injection vulnerability because the payload is persisted in the generated HTML file. ### Attack Path 1. An atta ...[truncated 1339 chars]

Remediation

View remediation

``` 8. Add regression tests covering raw tags, event handlers, malformed attributes, dangerous URI schemes, and encoded payloads. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: assets/presentation-helper.sh:84

Finding

Predictable shared temporary file permits symlink overwrite and concurrent metadata corruption

Content

View full analysis

"$tmp" ``` The file is later processed and removed: ```bash validate_json "$tmp" local pres_id if command -v jq &>/dev/null; then pres_id=$(jq -r '.presentation_id // empty' "$tmp") else pres_id=$(grep -o '"presentation_id": *"[^"]*"' "$tmp" | head -1 | cut -d'"' -f4) fi cp "$tmp" "$target" rm -f "$tmp" ``` ### Technical Analysis The helper uses a fixed path in the globally shared `/tmp` directory. It does not create the file exclusively, verify ownership, reject symbolic links, or assign restrictive permissions before writing. Shell redirection follows symbolic links. A local attacker who can write to `/tmp` can therefore pre-create `/tmp/pres_meta_tmp.json` as a symbolic link to another file writable by the user running the Skill. When `cat > "$tmp"` executes, the linked target is truncated and replaced with presentation metadata. The fixed filename also creates a race between concurrent Skill executions. One process may validate or copy data written by another process, resulting in metadata corruption or cross-session disclosure. ### Attack Path 1. A local attacker predicts the fixed path `/tmp/pres_meta_tmp.json`. 2. The attacker creates a symbolic link at that path pointing to a file writable by the victim. 3. The victim invokes `save-meta`. 4. The redirection `cat > "$tmp"` follows the symbolic link. 5. The linked target is truncated and overwritten with supplied JSON. 6. The helper later removes the link, obscuring the temporary artifact. A concurrent-execution variant is also possible: 1. Two presentation saves run at the same time. 2. Both use the same temporary path. 3. Their writes, validation, copying, and deletion race. 4. One presentation may receive the o ...[truncated 499 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:902

Finding

Unpinned third-party package installation creates supply-chain exposure

Content

View full analysis

**Requires:** `python3` + `python-pptx` (`pip install python-pptx`) ``` The Agent workflow instructs: ```markdown 1. Check: `python3 -c "import pptx" 2>/dev/null` 2. If missing → "Install with: `pip install python-pptx`. Want me to try?" 3. Once available, run the export ``` ### Technical Analysis The installation command retrieves the latest available release and its dependency graph without: - Pinning a reviewed version. - Verifying package hashes. - Enforcing a trusted package index. - Using a locked dependency file. - Isolating the package in a dedicated virtual environment. Although `python-pptx` is a legitimate package, installation behavior can change over time. A compromised upstream release, malicious mirror, dependency takeover, or unexpected future release could execute code during installation or later import. The Skill asks for user approval before attempting installation, which reduces surprise, but approval alone does not provide package authenticity or reproducibility. ### Attack Path 1. The user requests PPTX export. 2. The Skill checks for the `pptx` module and determines that it is absent. 3. The Agent offers to run `pip install python-pptx`. 4. The user approves the installation. 5. `pip` resolves the latest package and transitive dependencies from its configured index. 6. A compromised or substituted package is installed. 7. Malicious code executes during package installation or when the exporter imports `pptx`. ### Impact Assessment A malicious dependency executes with the privileges of the account running the Agent. It could read or modify files available to that account, access presentation data, use network connectivity, or alter the Python environment. The command does not request administrative privileges, so direct root-le ...[truncated 144 chars]

Remediation

View remediation

--hash=sha256: ``` 3. Install with: ```bash python3 -m pip install --require-hashes -r requirements.lock ``` 4. Use a dedicated virtual environment instead of modifying the Agent's global Python environment. 5. Explicitly configure an approved HTTPS package index and disable unintended extra indexes. 6. Review and lock transitive dependencies. 7. Preserve the existing explicit user-consent step before installing anything. 8. Where feasible, package reviewed dependencies with the Skill or provide PPTX export as an optional isolated component. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (24)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill claims broad AI-assisted deck generation and export capabilities, but the documented behavior suggests mostly static slide rendering without the promised validation and generation steps. Overstated capabilities are dangerous in security-sensitive agent ecosystems because users and orchestrators may authorize the skill based on false assumptions about its controls and outputs.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill claims broad AI-assisted deck generation and export capabilities, but the documented behavior suggests mostly static slide rendering without the promised validation and generation steps. Overstated capabilities are dangerous in security-sensitive agent ecosystems because users and orchestrators may authorize the skill based on false assumptions about its controls and outputs.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill claims broad AI-assisted deck generation and export capabilities, but the documented behavior suggests mostly static slide rendering without the promised validation and generation steps. Overstated capabilities are dangerous in security-sensitive agent ecosystems because users and orchestrators may authorize the skill based on false assumptions about its controls and outputs.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill claims broad AI-assisted deck generation and export capabilities, but the documented behavior suggests mostly static slide rendering without the promised validation and generation steps. Overstated capabilities are dangerous in security-sensitive agent ecosystems because users and orchestrators may authorize the skill based on false assumptions about its controls and outputs.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill claims broad AI-assisted deck generation and export capabilities, but the documented behavior suggests mostly static slide rendering without the promised validation and generation steps. Overstated capabilities are dangerous in security-sensitive agent ecosystems because users and orchestrators may authorize the skill based on false assumptions about its controls and outputs.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 55% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 449)May include surrounding context.

md

> - "Don't compare to competitors by name"
> - "Don't say 'this will definitely...' — say 'based on what we've seen...'"
> - "Don't skip the costs slide — transparency builds trust"
> - "Don't apologize for early results — frame as experiments"

---

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · assets/presentation-helper.sh (reported line 96)May include surrounding context.

sh

pres_id=$(grep -o '"presentation_id": *"[^"]*"' "$tmp" | head -1 | cut -d'"' -f4)
  fi
  
  [[ -z "$pres_id" ]] && { echo "ERROR: No presentation_id in JSON" >&2; rm -f "$tmp"; return 1; }
  
  local safe_id
  safe_id=$(sanitize_filename "$pres_id")

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · assets/presentation-helper.sh (reported line 198)May include surrounding context.

sh

[[ -f "$deck" ]] && { rm -f "$deck"; deleted=$((deleted + 1)); }
  
  # Also remove exports
  rm -f "${EXPORTS_DIR}/${safe_id}".*  2>/dev/null
  
  if [[ $deleted -gt 0 ]]; then
    echo "✅ Deleted: ${safe_id} (${deleted} files)"

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill describes and instructs file read/write behavior but does not declare an explicit tool scope such as allowed tools or permissions. In an agent environment, this can lead to broader-than-expected file access and makes policy enforcement rely on prompt text rather than platform controls.

Content

No source excerpt is available for this finding.

Behavior Manipulation

Medium

• Category: Prompt Injection
• Confidence: 75% confidence

Finding

Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md

## ⛔ AGENT RULES — READ BEFORE DOING ANYTHING

> 1. **Use EXACT text from this file.** Do not paraphrase menus, slide type names, or instructions. Copy them verbatim.
> 2. **NEVER tell the user to open a terminal or run commands.** You have the exec tool. USE IT. Run every command yourself via exec.
> 3. **One step at a time.** Interview questions go 1-2 at a time. Never dump the full questionnaire.
> 4. **NEVER overwrite existing presentation files without asking.** If the file exists, ask before replacing.
> 5. **FACTUAL VALIDATION IS MANDATORY.** Before generating any slide, check for speculative language. Flag it. The user decides what stays.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md

> 1. **Use EXACT text from this file.** Do not paraphrase menus, slide type names, or instructions. Copy them verbatim.
> 2. **NEVER tell the user to open a terminal or run commands.** You have the exec tool. USE IT. Run every command yourself via exec.
> 3. **One step at a time.** Interview questions go 1-2 at a time. Never dump the full questionnaire.
> 4. **NEVER overwrite existing presentation files without asking.** If the file exists, ask before replacing.
> 5. **FACTUAL VALIDATION IS MANDATORY.** Before generating any slide, check for speculative language. Flag it. The user decides what stays.
> 6. **Scope: ~/workspace/presentations/ only.** All file operations stay under this directory.
> 7. **USE THE HELPER SCRIPT FOR ALL FILE OPERATIONS.** Never construct raw shell commands with user input. Always route through `assets/presentation-helper.sh`.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill says all file operations must use the helper script and remain under a restricted directory, yet other instructions tell the agent to perform raw reads outside that boundary. Conflicting guidance weakens defense-in-depth because the safety model depends on consistent use of the helper rather than discretionary agent behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill states that operations stay within ~/workspace/presentations, but it instructs the agent to probe unrelated workspace files like SOUL.md and AGENTS.md. This breaks the stated trust boundary and can lead to unintended access to unrelated sensitive data in the user's workspace.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Broad natural-language triggers such as 'or similar' can cause the skill to activate on ambiguous user requests that were not intended to invoke file operations or workflow changes. In agent settings, unintended activation can lead to premature data collection, file access, or execution of helper commands.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The instruction to flexibly map natural language to commands is overly broad and can misclassify ordinary conversation as actionable requests. This is especially risky in a skill that performs filesystem operations, because a mistaken match may expose, modify, export, or delete presentations without clear user intent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The header claims all user input is code-enforced sanitized, but cmd_save_deck writes arbitrary Markdown from stdin directly to disk without content validation or sanitization. In this skill context, that matters because the saved deck is later fed into export tools such as pandoc and external scripts, increasing the chance that hostile Markdown/embedded content could trigger unsafe downstream behavior or produce active content in generated outputs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This command executes another shell script via bash, which is a safety-relevant subprocess action. The file's help text mentions export behavior generally, but it does not explicitly warn that this path launches another shell script, so users may not realize additional local code will be executed.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The renderer converts markdown inline syntax into raw HTML without first escaping user-controlled content, so deck content can inject active HTML/JavaScript via crafted links or markup into the exported presentation. Because the output is an HTML file intended to be opened in a browser, this becomes a stored client-side injection issue that can execute script in the viewer’s browser or abuse browser features when the file is opened.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

SLIDE_TYPES declares text_and_image as a split layout with fields title, body, image_path, and image_caption, implying text on the left and image on the right. But the dispatcher maps text_and_image to gen_screenshot, which implements a full-width image slide using title, subtitle, image_path, and caption, so the code does not do what the documentation says.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest describes exports to Markdown, PPTX, and PDF, but this helper also implements export-html and export-gamma commands. Those are product-capability additions beyond the stated description, not merely an internal implementation detail.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This code invokes a separate Python script to generate HTML output, which is a subprocess-style operation and writes a new file, but there is no inline comment or user-facing disclosure at the execution point describing that behavior. Although the command name suggests export functionality, this specific external-script execution is not otherwise warned about in this file's usage/help text.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The template emits <html lang="en"> for all presentations, which forces an English locale marker regardless of the source deck language. This is a natural-language policy concern because the file does not offer a language choice or explain why English is required.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This code file generates output that causes the user's browser to contact fonts.googleapis.com when the HTML is opened. Although the script documents its general purpose, it does not disclose this network behavior in comments, usage text, or other user-facing messaging near the operation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The generated HTML is not self-contained because it imports Google Fonts and Font Awesome from external CDNs. In a presentation generator, this creates privacy, integrity, and availability risks: opening the slides can trigger outbound network requests, leak metadata, and make rendering dependent on third-party resources that could be unavailable or modified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.