bd1

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:42 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Chinese brand-analysis assistant, but users should review its automatic PPT export and dependency guidance before installing.

Install only if you want a Chinese-language brand-analysis workflow that may create PPT files. Before using it, approve any output path yourself and prefer a local, pinned pptxgenjs dependency instead of a global npm install.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:83

Finding

Unsafe Global Installation of an Unpinned npm Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 83-85
Vulnerability Type: Supply-chain exposure through an unpinned global dependency
Risk Level: Medium

Vulnerable Code Snippet

markdown

### After Generation

- If generation fails because the dependency is unavailable, instruct the user to install it with `npm install -g pptxgenjs`.

Technical Analysis

The skill instructs the user to install pptxgenjs globally without specifying a reviewed version, lockfile, package integrity hash, or trusted package snapshot. Consequently, the installed code is determined by the package registry at installation time rather than by the audited skill package.

The global installation scope also gives the package and its installation lifecycle scripts broader influence than a project-local dependency. If the package, one of its transitive dependencies, or the relevant registry account is compromised, arbitrary package lifecycle code could execute under the privileges of the user running npm.

The skill does not execute this command automatically; exploitation requires the user or agent environment to follow the installation instruction.

Attack Path

1. PPTX generation fails because pptxgenjs is unavailable.
2. The skill tells the user to run npm install -g pptxgenjs.
3. npm resolves the current package and its transitive dependencies from the configured registry.
4. A compromised or unexpectedly modified package is downloaded.
5. Package lifecycle scripts execute with the invoking user's permissions.
6. Malicious code may access data or modify resources available to that user.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user who performs the global installation. The reachable scope may include user files, environment variables, npm configuration, globally installed Node.js tools, and other resources available to that account. Admin ...[truncated 98 chars]

Remediation

View remediation

Remediation Suggestions

• Pin pptxgenjs to a specifically reviewed version.

• Install it within a dedicated project directory rather than globally.

• Commit and enforce a lockfile with package integrity metadata.

• Use a trusted registry and verify package provenance where supported.

• Disable package lifecycle scripts during installation unless they are explicitly required and reviewed.

• Require explicit user approval before installing any dependency.

• Replace the instruction with a controlled setup process, such as:

  bash

  npm install --save-exact --ignore-scripts pptxgenjs@REVIEWED_VERSION
  

• Review all transitive dependencies before permitting lifecycle scripts or using the package in a sensitive environment.

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: SKILL.md:56

Finding

Unconditional File Creation Outside the Project Workspace

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 56-62
Vulnerability Type: Unapproved filesystem write to a hard-coded user directory
Risk Level: Low

Vulnerable Code Snippet

markdown

## Final Output: Generate a PPT on the Desktop

After every analysis, the structured result must be generated as a `.pptx` file and saved at:

C:\Users\Lenovo\Desktop\BD1_[module-name]_[topic-keyword].pptx

Technical Analysis

The skill mandates a filesystem write to a fixed desktop directory after every analysis. It does not request user authorization, confirm the destination, check whether the target belongs to the current user, or default to an isolated project output directory.

The filename also incorporates a topic keyword derived from user input. The reviewed text does not define filename sanitization, canonicalization, collision handling, or overwrite prevention. Depending on the eventual PPTX-generation implementation, malformed filename components could cause generation failures, unintended path interpretation, or replacement of an existing file with the same name.

The hard-coded username makes the behavior non-portable. On a different system, the operation may fail or may target an unrelated account's directory if the process has sufficient access. No implementation script was present in the audited project, so path traversal or arbitrary overwrite is not confirmed; the verified issue is the unconditional out-of-workspace write requirement.

Attack Path

1. A user requests one of the supported brand-analysis operations.
2. The skill requires creation of a PPTX regardless of whether the user requested a file.
3. A topic-derived filename is constructed for the fixed desktop directory.
4. The agent attempts to write outside the project workspace without destination confirmation.
5. If a file with the generated name already exists and the generator permits replacement, it may be overwritten; othe ...[truncated 701 chars]

Remediation

View remediation

Remediation Suggestions

• Obtain explicit user consent before creating a file.
• Ask the user to select or approve the output destination.
• Default to a sandboxed output directory inside the project workspace.
• Resolve and validate the final path before writing.
• Sanitize topic and module components using a strict filename allowlist.
• Reject directory separators, drive prefixes, traversal sequences, control characters, and reserved device names.
• Generate collision-resistant filenames or request confirmation before overwriting.
• Use exclusive file creation where supported.
• Avoid hard-coded usernames and platform-specific paths.
• Report the actual resolved output path after successful creation.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The listed triggers include generic phrases such as '品牌分析', '设计逻辑', '行业趋势', and '资料整理', which can naturally appear in ordinary conversation about design work. The file does not provide exclusion conditions or negative examples to clarify when the skill should not activate, increasing the risk of unintended invocation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill expands from passive brand-analysis assistance into mandatory local file generation and saving to a fixed desktop path, which is a scope escalation from analysis into device-side side effects. This is dangerous because it causes automatic persistence on the user's machine without necessity for the stated task and creates opportunities for unwanted file writes or abuse of local execution-capable tooling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs saving a PPT to the user's desktop without warning or consent, creating an unauthorized side effect on the local system. Unprompted file creation violates least astonishment and can be abused to clutter the filesystem, overwrite content, or condition users to accept silent writes.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Hardcoding writes to C:\Users\Lenovo\Desktop\... is not justified by a brand research assistant's purpose and introduces unnecessary local filesystem interaction. A fixed path can overwrite user files, fail unpredictably across environments, and normalizes privileged behavior unrelated to the core analytical function.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown skill file presents all instructions and output expectations exclusively in Chinese. Under the policy rule for natural-language violations, forcing a specific language without user opt-in or documented justification is a locale-policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown skill specifies all instructions and outputs exclusively in Chinese, which can amount to a language/locale policy constraint without offering user opt-in or documenting a justified regional limitation. Under the policy, forcing a specific language without user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The skill instructions, trigger phrases, and output requirements are entirely specified in Chinese, implying a fixed language mode for interaction and outputs. There is no statement that users may choose another language, nor a documented justification that the skill is intentionally limited to a Chinese-language or region-specific workflow.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file contains user-facing natural-language instructions solely in Chinese and does not indicate that users may choose another language. Under the language/locale policy rule, forcing a specific language without user opt-in is a policy concern unless clearly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The entire skill specification is written only in Chinese and presents output sections and instructions exclusively in Chinese, with no indication that the user may choose another language. This can violate a language/locale policy when skills must not force a specific language without user opt-in or explicit region-specific justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.