ClawHub
Back to skill

Security audit

Emar PPT Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent presentation-deck generator, but its generated HTML loads third-party fonts and mutable remote JavaScript without clear user-facing disclosure.

Install only if you are comfortable with generated presentations making outbound requests and running CDN-hosted browser JavaScript. For confidential internal decks, remove or vendor the remote Lucide, Motion, font, MapLibre, and tile dependencies before sharing or opening the output.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning
Location
assets/template.html:760
Finding

Generated slide decks execute remotely hosted JavaScript without immutable integrity verification

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (39)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The code chunk does not implement presentation deck generation, HTML slide authoring, Emar branding, or single-file PPT export. Instead, it is a third-party minified animation runtime used to animate elements and respond to scrolling, resizing, and viewport visibility. While such a library could support visual effects inside a slide deck, its actual primary function is generic motion/animation infrastructure, which is materially different from the declared purpose of creating Emar-branded HTML presentation decks.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md
- `assets/template.html`: Style A, electronic magazine plus e-ink, serif titles, fluid visual background, warmer editorial feeling.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md
- `assets/template.html`: Style A, electronic magazine plus e-ink, serif titles, fluid visual background, warmer editorial feeling.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md
- `assets/template-swiss.html`: Style B, Swiss International Style, grid-first layout, high contrast anchor color, stronger data/report feeling.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md
- `assets/template-swiss.html`: Style B, Swiss International Style, grid-first layout, high contrast anchor color, stronger data/report feeling.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

md
node scripts/validate-swiss-deck.mjs <path-to-index.html>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/template-swiss.html (reported line 1246)May include surrounding context.

html
<div id="deck">

<!-- ============================================================
     SLIDES 插入区 · 在此处填充所有 <section class="slide ..."> 页面
     页面骨架参考 references/layouts-swiss.md
     主题色配置参考 references/themes-swiss.md

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/template.html (reported line 506)May include surrounding context.

html
<div id="deck">

<!-- ============================================================
     SLIDES 插入区 · 在此处填充所有 <section class="slide ..."> 页面
     每页模板参考 references/page-patterns.md
     页面组件参考 references/components.md

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/checklist.md (reported line 97)May include surrounding context.

  • split 模式例外:.slide.split .canvas-card{padding:0},两个 .half 自己定 padding:5.6vh 3.6vw 4.4vh
html
<!-- ❌ 错:主体多缩了 5vw,左右对不齐 -->
<div class="canvas-card">
  <div class="chrome-min">...</div>
  <div style="flex:1;padding:5vh 5vw 4vh;...">主体</div>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/components.md (reported line 29)May include surrounding context.

每一页都是一个 <section class="slide ...">。必须包含 data-theme 属性（light 或 dark），JS 翻页时会根据这个属性切换背景。

html
<section class="slide light" data-theme="light">   <!-- 浅色页 -->
<section class="slide dark" data-theme="dark">     <!-- 深色页 -->
<section class="slide light hero" data-theme="light">  <!-- Hero 页：浅色 + 薄遮罩透出 WebGL -->
<section class="slide dark hero" data-theme="dark">    <!-- Hero 页：深色 + 薄遮罩 -->

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/components.md (reported line 29)May include surrounding context.

每一页都是一个 <section class="slide ...">。必须包含 data-theme 属性(light 或 dark),JS 翻页时会根据这个属性切换背景。

html
<section class="slide light" data-theme="light">   <!-- 浅色页 -->
<section class="slide dark" data-theme="dark">     <!-- 深色页 -->
<section class="slide light hero" data-theme="light">  <!-- Hero 页:浅色 + 薄遮罩透出 WebGL -->
<section class="slide dark hero" data-theme="dark">    <!-- Hero 页:深色 + 薄遮罩 -->

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/components.md (reported line 318)May include surrounding context.

html
<i data-lucide="compass" class="ico-lg"></i>     <!-- 大图标（pillar 用） -->
<i data-lucide="target" class="ico-md"></i>      <!-- 中图标（列表项用） -->
<i data-lucide="check-circle" class="ico-sm"></i>  <!-- 小图标（inline 用） -->

常用 Lucide 图标名（按含义分组）：

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/components.md (reported line 318)May include surrounding context.

html
<i data-lucide="compass" class="ico-lg"></i>     <!-- 大图标(pillar 用) -->
<i data-lucide="target" class="ico-md"></i>      <!-- 中图标(列表项用) -->
<i data-lucide="check-circle" class="ico-sm"></i>  <!-- 小图标(inline 用) -->

常用 Lucide 图标名(按含义分组):

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/layouts-swiss.md (reported line 101)May include surrounding context.

如果在主体那层再写 padding:5vh 5vw 4vh,水平方向就变成 5vw + 5vw = 10vw,主体比 chrome-min 多内缩一圈,左右对不齐。

html
<!-- ❌ 错:主体多缩了 5vw -->
<div class="canvas-card">
  <div class="chrome-min">...</div>
  <div style="flex:1;padding:5vh 5vw 4vh;...">主体内容</div>

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/template-swiss.html (reported line 1)May include surrounding context.

html
# 截图美化语义规则

用于把用户提供的产品截图、网页截图、代码截图、设计稿截图处理成符合模板比例的图片资产。目标是类似 CleanShot X 的“截图居中 + 背景填充 + 统一比例”,而不是默认让 GPT-M 2.0 重画截图。

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/template.html (reported line 1)May include surrounding context.

html
# 截图美化语义规则

用于把用户提供的产品截图、网页截图、代码截图、设计稿截图处理成符合模板比例的图片资产。目标是类似 CleanShot X 的“截图居中 + 背景填充 + 统一比例”,而不是默认让 GPT-M 2.0 重画截图。

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/checklist.md (reported line 1)May include surrounding context.

md
# 截图美化语义规则

用于把用户提供的产品截图、网页截图、代码截图、设计稿截图处理成符合模板比例的图片资产。目标是类似 CleanShot X 的“截图居中 + 背景填充 + 统一比例”,而不是默认让 GPT-M 2.0 重画截图。

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/components.md (reported line 1)May include surrounding context.

md
# 截图美化语义规则

用于把用户提供的产品截图、网页截图、代码截图、设计稿截图处理成符合模板比例的图片资产。目标是类似 CleanShot X 的“截图居中 + 背景填充 + 统一比例”,而不是默认让 GPT-M 2.0 重画截图。

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/screenshot-framing.md (reported line 1)May include surrounding context.

md
# 截图美化语义规则

用于把用户提供的产品截图、网页截图、代码截图、设计稿截图处理成符合模板比例的图片资产。目标是类似 CleanShot X 的“截图居中 + 背景填充 + 统一比例”,而不是默认让 GPT-M 2.0 重画截图。

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The root HTML element hard-codes lang="zh-CN", which makes the template default to a specific language/locale for all generated content. This file is a generic presentation template rather than a clearly region-specific tool, and it does not offer user opt-in or explain why a Chinese locale is required.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The file is advertised as a single HTML artifact but is not actually self-contained because it depends on remote fonts and script fallback behavior. In an internal-use deck generator, that mismatch can mislead users into opening the file in restricted or sensitive environments while unintentionally creating external connections and functional instability.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The template fetches fonts from Google-hosted CDNs even though it is described as a single-file HTML PPT. This creates a supply-chain and privacy dependency: opening the deck causes outbound network requests that can fail, be blocked, leak viewer metadata, or serve altered content if the remote resource is compromised.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The template imports JavaScript from public CDNs (unpkg/jsDelivr) for icons and animation fallback, so opening the HTML executes remote code in the viewer's browser. That turns a local presentation into code that is partially controlled by third parties, enabling supply-chain compromise, tracking, or unexpected script behavior if the CDN content changes or is tampered with.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The template fetches Google Fonts from third-party domains, which contradicts the stated single-file/offline deck purpose and creates privacy, availability, and supply-chain exposure. Opening the generated deck will leak viewer IP/User-Agent and fail or render differently in restricted or offline environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The deck silently contacts third-party font providers without informing the user, causing undisclosed metadata leakage whenever the HTML is opened. In an internal-use presentation skill, that hidden network behavior is more concerning because users reasonably expect a local artifact, not external telemetry.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.