ZM Image2PPT 视觉幻灯片生成

• Outcome: Review
• Latest audit: Jun 23, 2026 · 7:47 PM UTC
• Version: 0.1.0

Overview

This skill does what it claims, but it handles API keys, uploads slide/template content to configurable model services, and includes broad optional execution paths that deserve user review before installation.

Install only if you are comfortable with a deck-generation skill that can send slide text and template images to the OpenAI-compatible endpoints you configure. Avoid using confidential templates unless you trust those endpoints, prefer platform secret storage or manually managed environment variables over giving an agent your API key, and avoid the `--backend codex` and Docker template-rendering paths unless you understand their broader local authority.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (29)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

copied_for_run = True
        try:
            mount_src = str(out_dir).replace("\\", "/") if sys.platform == "win32" else str(out_dir)
            subprocess.run(
                ["docker", "run", "--rm",
                 "-v", f"{mount_src}:/work",
                 "--entrypoint", "soffice",

• Confidence: 79% confidence
• Finding: The code launches a containerized LibreOffice process on user-supplied PPTX content and bind-mounts a host directory into the container. While it avoids shell injection, processing untrusted office files through LibreOffice or a mutable third-party Docker image can expose the host to parser exploits, malicious document-triggered behavior, or supply-chain risk from the image itself.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill instructs the agent to read and write files, access environment-provided credentials, invoke shell commands, and make network calls, but it does not declare those permissions up front. That creates a transparency and least-privilege problem: a caller may invoke the skill without realizing it can clone repositories, load API keys from local .env locations, render PPTs via local tools or Docker, and send slide content to external model endpoints.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The guide explicitly instructs the agent to solicit an OpenAI API key from the user and persist it in a local .env file. Even if intended for normal setup, this expands the skill from slide generation into credential collection and storage, which increases the attack surface if the directory is later exposed, synced, logged, or reused by other tools.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: This backend delegates image generation to `codex exec --full-auto`, which grants a general-purpose autonomous agent broad ability to interpret prompts and potentially perform additional actions beyond simple image creation. Because the instruction embeds untrusted prompt content and absolute filesystem paths, a prompt-injection or model-misbehavior path could cause unintended file access, command execution, or modification of local artifacts under the user's authority.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code accepts arbitrary URLs extracted from model output and fetches them with requests.get, which gives the skill a general outbound network retrieval capability beyond image generation. Because the model response is untrusted, this can be abused for SSRF-style access to internal services, unexpected data exfiltration routes, or downloading attacker-controlled content to disk.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The analyzer base64-encodes full slide images and sends them to a configurable external vision/chat-completions endpoint. PPT slides often contain confidential business data, branding, customer information, or unpublished content, so this creates a real data-exfiltration/privacy risk if users are not clearly warned and the endpoint is not tightly controlled.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The README encourages template-cloning of arbitrary .pptx files and explicitly supports vision analysis via external multimodal providers, but it does not clearly warn users that slide content may be rendered to images and sent to third-party APIs. In a presentation-generation skill, this creates a realistic risk of unintentional disclosure of confidential business data, customer information, or internal branding assets.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The instructions tell the agent to request a secret and write it into a .env file, but they do not warn the user that the credential will be stored locally in plaintext. This creates a secrecy and consent problem: users may disclose a high-value API key without understanding persistence, backup, and accidental exposure risks.

Missing User Warnings

Low

• Confidence: 72% confidence
• Finding: The cleanup step recommends rm -rf on a temporary path without any cautionary note or validation. In an agent-executed context, destructive shell commands deserve extra care because path mistakes, variable substitution errors, or user modifications could cause unintended deletion.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Slide content and generated prompts are sent to a remote API, and the script is explicitly designed to support arbitrary OpenAI-compatible endpoints, including proxy services. Users may unknowingly disclose sensitive presentation content to third parties because there is no explicit consent flow, redaction step, or strong warning at the transmission point.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: This code transmits full slide images and some template metadata to an external API without any user-facing consent or warning in the file's flow. In this skill context, templates are likely to be proprietary presentation assets, so silent off-host transmission materially increases confidentiality and compliance risk.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: This section provides a plain-language workflow for collecting and storing sensitive credentials, including the exact prompt the agent should use and the destination file. That makes the skill materially capable of handling secrets, which is risky in untrusted agent environments where chat logs, workspace files, or plugins may expose them.

External Transmission

Medium

• Category: Data Exfiltration

Content

start_time = time.time()

        try:
            resp = requests.post(
                url,
                json=payload,
                headers=self.headers,

• Confidence: 97% confidence
• Finding: The code performs external network transmission of user-provided slide content and prompts via requests.post to a configurable remote endpoint. In this skill context, that is expected functionality, but it still creates a real confidentiality risk because the destination can be any user-configured OpenAI-compatible service.

External Transmission

Medium

• Category: Data Exfiltration

Content

last_err: Optional[Exception] = None
        for attempt in range(1, VISION_MAX_RETRIES + 1):
            try:
                resp = requests.post(
                    self.endpoint, headers=headers, json=payload, timeout=VISION_TIMEOUT_SECS
                )
                if resp.status_code != 200:

• Confidence: 96% confidence
• Finding: The requests.post call sends the assembled payload, including base64-encoded images, to a remote endpoint derived from environment configuration. Because the destination is externally configurable and the payload includes sensitive visual content, this is a genuine external-transmission risk in a template-analysis tool.

Unvalidated Output Injection

High

• Category: Output Handling

Content

print(f"🔗 [scene {scene_index}] dispatching to codex ({len(instruction)} chars)")
        try:
            result = subprocess.run(
                argv,
                capture_output=True,
                text=True,

• Confidence: 93% confidence
• Finding: The code sends untrusted prompt text directly into a powerful external agent as operational instructions, not as inert data. Even though shell injection is avoided, this is still an instruction-injection surface: a crafted `image_prompt` can try to override the intended task, persuade the agent to read local files, write to unexpected locations, or take other actions available to `codex exec --full-auto`.

Credential Access

High

• Category: Privilege Escalation

Content

安装脚本是**交互式**的，如果目标目录已存在会问是否覆盖；agent 可以用 `yes | bash install_as_skill.sh` 自动选"是"，或先检查目录是否存在再决定。

### 3. 只有在走 API 直连时才配置 .env

如果当前 agent 就是带原生图片生成能力的 Codex，可以跳过这一步，直接重启后走 `SKILL.md` 里的原生出图路径。

• Confidence: 88% confidence
• Finding: In context, the .env configuration section is tied to asking the user for an API key and writing it to disk, which constitutes credential access and handling behavior. While common in setup docs, it is more dangerous here because the content is explicitly designed for autonomous agents to execute, increasing the chance of secrets being captured in logs, stored insecurely, or processed without clear user review.

Credential Access

High

• Category: Privilege Escalation

Content

print_info "取消"
            exit 0
        fi
        # 备份用户的 .env
        if [ -f "$SKILL_DIR/.env" ]; then
            cp "$SKILL_DIR/.env" "/tmp/gpt-image2-ppt.env.bak"
            print_info "已备份现有 .env 到 /tmp/gpt-image2-ppt.env.bak"

• Confidence: 96% confidence
• Finding: The script copies the user's .env file, which may contain API keys, to a predictable world-accessible temporary path under /tmp. On multi-user systems, another local user or a symlink attack could read or redirect that backup, resulting in credential exposure or overwrite of arbitrary files.

Credential Access

High

• Category: Privilege Escalation

Content

exit 0
        fi
        # 备份用户的 .env
        if [ -f "$SKILL_DIR/.env" ]; then
            cp "$SKILL_DIR/.env" "/tmp/gpt-image2-ppt.env.bak"
            print_info "已备份现有 .env 到 /tmp/gpt-image2-ppt.env.bak"
        fi

• Confidence: 98% confidence
• Finding: This line performs the actual backup of .env credentials to /tmp/gpt-image2-ppt.env.bak, a predictable temporary filename. Predictable temp files are unsafe because they can be read by other users if permissions are weak, or abused via symlink/hardlink attacks to redirect sensitive data.

Credential Access

High

• Category: Privilege Escalation

Content

print_success "文件复制完成"

    # 恢复备份的 .env
    if [ -f "/tmp/gpt-image2-ppt.env.bak" ]; then
        mv "/tmp/gpt-image2-ppt.env.bak" "$SKILL_DIR/.env"
        print_success "已恢复用户 .env"

• Confidence: 95% confidence
• Finding: This line checks for the presence of the temporary backup file in /tmp, continuing the insecure secret-handling pattern. Using a predictable temp filename for credential material creates risk of tampering, substitution, or exposure before restoration.

Credential Access

High

• Category: Privilege Escalation

Content

# 恢复备份的 .env
    if [ -f "/tmp/gpt-image2-ppt.env.bak" ]; then
        mv "/tmp/gpt-image2-ppt.env.bak" "$SKILL_DIR/.env"
        print_success "已恢复用户 .env"
    fi

• Confidence: 97% confidence
• Finding: Restoring .env from a predictable /tmp path means the script trusts data from a shared location that may have been modified by another local actor. This can lead not only to secret exposure but also to configuration injection by replacing the backup with attacker-controlled content.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31
python-dotenv>=1.0
python-pptx>=1.0
jsonschema>=4.0

• Confidence: 97% confidence
• Finding: The dependency is specified with a lower bound only (`requests>=2.31`), which allows future installs to resolve to different versions over time. This creates supply-chain and reproducibility risk because a later release could introduce breaking changes or newly disclosed vulnerabilities without any change to this repository.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31
python-dotenv>=1.0
python-pptx>=1.0
jsonschema>=4.0
pymupdf>=1.24

• Confidence: 96% confidence
• Finding: `python-dotenv>=1.0` is unpinned, so installations are not reproducible and may pull in newer versions with different behavior or security issues. In build and deployment pipelines, this weakens change control over third-party code.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31
python-dotenv>=1.0
python-pptx>=1.0
jsonschema>=4.0
pymupdf>=1.24

• Confidence: 96% confidence
• Finding: `python-pptx>=1.0` permits any later version, which increases supply-chain exposure and makes builds non-deterministic. For a content-generation skill, dependency drift can silently change document-processing behavior or introduce vulnerable transitive packages.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31
python-dotenv>=1.0
python-pptx>=1.0
jsonschema>=4.0
pymupdf>=1.24

• Confidence: 96% confidence
• Finding: `jsonschema>=4.0` is not pinned, allowing arbitrary later versions to be installed. That increases the chance of pulling a compromised or incompatible release and reduces auditability of the software supply chain.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

python-dotenv>=1.0
python-pptx>=1.0
jsonschema>=4.0
pymupdf>=1.24

• Confidence: 96% confidence
• Finding: `pymupdf>=1.24` is unpinned, which creates non-reproducible installs and elevates supply-chain risk. Because this library processes document content, unintended upgrades could affect parsing security and stability.

Static analysis

No suspicious patterns detected.