Security audit

Emar PPT Skill

Security checks across malware telemetry and agentic risk

Overview

This presentation-template skill is mostly coherent, but generated internal decks silently contact third-party services and can run CDN-hosted JavaScript when opened.

Review before installing if decks may contain internal or confidential material. Prefer a revised version that vendors fonts and JavaScript locally, removes CDN fallbacks or pins and discloses them, and replaces absolute local reference paths with bundled relative references. I found no evidence of malware, credential theft, or destructive behavior.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The template pulls fonts from Google-hosted CDNs at runtime, which creates external network dependencies, leaks client metadata, and allows deck rendering to be influenced by third-party availability or upstream changes. For an internal-use 'single HTML' deck generator, this also breaks the implied offline/self-contained trust boundary and can expose usage patterns to external providers.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The template loads runtime dependencies from unpkg and jsDelivr, so opening the generated HTML causes arbitrary third-party JavaScript to execute in the browser context. This introduces supply-chain and privacy risk, and means the supposedly single-file deck is not actually self-contained or deterministic.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: The template loads third-party resources from Google Fonts even though it is presented as a single-file HTML deck generator. This creates unnecessary outbound network access, leaks viewer metadata such as IP/user agent/referrer to external parties, and makes rendering depend on third-party availability.

Description-Behavior Mismatch

Medium

Confidence: 99% confidence
Finding: The template pulls executable code from external CDNs (Lucide and Motion fallback), which contradicts the single-file/offline expectation and introduces a supply-chain risk. If the CDN content is modified or blocked, the deck can execute untrusted code or fail unpredictably.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: An internal HTML presentation generator does not need network access to third-party font CDNs for core functionality. Granting that capability expands the attack surface and causes data exposure to external services whenever a deck is opened.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The template silently contacts external providers without informing the user, which is a security and privacy transparency failure. Users expecting a self-contained internal deck may unknowingly disclose access metadata to third parties.

Ssd 3

Low

Confidence: 89% confidence
Finding: The file embeds an absolute user-local filesystem path and instructs the agent to treat it as a golden source. In an agentic environment, natural-language instructions to consult local paths can cause unauthorized attempts to access host files, leak workstation structure, and couple behavior to sensitive local state.

Ssd 3

Low

Confidence: 91% confidence
Finding: The review workflow explicitly tells the model to open and compare against a PPT file at a user-specific absolute path. That is a stronger data-access instruction than passive documentation because it operationalizes local file access during generation/review, increasing the chance an agent will try to read non-workspace content or expose local environment details.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.