T09 · Insecure Skill Coding Practices
Error
- Location
scripts/codex_backend.py:105- Finding
Untrusted slide content is delegated to an autonomous full-access Codex agent
- Content
View full analysis
- Remediation
View remediation
Security audit
Gpt Image2 Ppt Skills
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a real PPT-generation tool, but it needs review because an optional backend delegates untrusted slide text to a full-auto Codex subprocess and a legacy script contradicts the stated credential scoping.
Install only if you are comfortable with the optional Codex backend's broad local authority, or avoid it entirely and use the default direct API/native image path. Prefer a scoped `.env`, review `OPENAI_BASE_URL` and `VISION_BASE_URL` before use, do not run the legacy root `generate_ppt.py`, and consider installing dependencies in a virtual environment.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
generate_ppt.py:44- Finding
Legacy entry point performs implicit parent-directory credential loading
- Content
View full analysis
bool: """ Find and load .env file from multiple locations. Search priority: 1. Current script directory 2. Parent directories up to project root 3. video_workflow project .env """ search_paths = [ Path(__file__).parent / ".env", Path.home() / ".claude" / "skills" / "gpt-image2-ppt-skills" / ".env", ] for env_path in search_paths: if env_path.exists(): load_dotenv(env_path, override=True) print(f"Loaded environment from: {env_path}") return True load_dotenv(override=True) print("Warning: No .env file found, using system environment variables") return False ``` ### Technical Analysis The final call to `load_dotenv(override=True)` does not receive an explicit path. Python Dotenv may search the current execution context and parent directories for a `.env` file. Values loaded from that file override existing process environment variables. This conflicts with the project's documented security assurance that credentials are loaded only from explicitly scoped Skill locations. The safer implementation in `scripts/generate_ppt.py` avoids this fallback, but the vulnerable root-level `generate_ppt.py` remains executable and may be selected accidentally. The loaded variables include `OPENAI_API_KEY` and `OPENAI_BASE_URL`. Consequently, an unrelated or attacker-controlled `.env` file can redirect presentation content and authorization headers to an unintended server. ### Attack Path 1. A user runs the root-level `generate_ppt.py` from a project directory. 2. No `.env` file exists at either explicitly checked location. 3. The script calls `load_dotenv(override=True)` without an explicit path. 4. Python Dotenv discov ...[truncated 855 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
install_as_skill.sh:122- Finding
Installer copies API credentials through a predictable shared temporary path
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Installer executes dependencies selected by unbounded version ranges
- Content
View full analysis
=2.31 python-dotenv>=1.0 python-pptx>=1.0 jsonschema>=4.0 pymupdf>=1.24 ``` ```bash print_info "Installing Python dependencies..." if command_exists pip3; then pip3 install -q -r "$SKILL_DIR/requirements.txt" else pip install -q -r "$SKILL_DIR/requirements.txt" fi print_success "Dependencies installed" ``` ### Technical Analysis All dependencies use lower-bound-only version constraints. The installer resolves and installs whichever future versions satisfy those constraints at installation time. There is no lock file, upper bound, package hash verification, or isolated virtual environment. The listed package names are recognizable, and the audit found no evidence of typosquatting or an intentionally malicious package. The risk is that future package releases, package-index compromise, dependency-account compromise, or incompatible transitive dependencies can change the code executed during installation without changing this repository. Python package installation may execute build backends and other installation-time logic with the permissions of the user running the installer. ### Attack Path 1. A dependency account, distribution artifact, package index, or transitive dependency is compromised, or an unsafe future version is published. 2. A user runs `install_as_skill.sh`. 3. Pip resolves the newest package versions satisfying the broad `>=` constraints. 4. The selected package or build backend executes during installation. 5. Malicious or incompatible code runs under the installing user's permissions. 6. The installed package may also affect subsequent Skill runs. ### Impact Assessment A compromised dependency may obtain the permissions of the user executing the installer, po ...[truncated 452 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (112)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The code’s core purpose generally aligns with image-based PPT slide generation and HTML viewer creation, so it is not unrelated or malicious. However, the declared description overstates important capabilities that are absent from the supplied code chunk. Specifically, there is no generation of a PowerPoint .pptx file, no parsing or imitation of a user-supplied .pptx template, and no built-in implementation of the named 10 curated styles beyond loading a provided style text file. Because these are user-visible primary capabilities rather than minor implementation details, this is a material description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared purpose focuses on end-user functionality: creating visually styled PPT slides and cloned-template presentations. The actual code shown does not generate slides, call gpt-image-2, create PPTX/HTML output, or implement presentation styles. Instead, it performs setup and deployment tasks for the skill itself. Those behaviors are materially different from the declared primary purpose and include filesystem modification and dependency installation that are not reflected in the description. While installation can support the overall project, this code chunk’s actual function is installer/configuration logic, not PPT generation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description presents a complete presentation-generation skill: style selection, template cloning from .pptx, and final outputs including an HTML viewer and a 16:9 PPTX. The actual code chunk is much narrower: it is a helper backend that shells out to
codex execto generate one slide image PNG based on an image prompt, with optional reference image guidance. While this could be a supporting component of a larger PPT-generation system, the supplied code itself does not perform the primary advertised functions. Therefore the description materially overstates what this code chunk actually does.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description is for a full presentation-generation skill: styled PPT slide creation, template-clone mode for .pptx inputs, and exporting both HTML viewer and .pptx. The supplied code chunk does not do those things. It is narrowly focused on generating and saving one image from a prompt via OpenAI-compatible endpoints, optionally using a reference image for visual style guidance. While this could be a supporting component of a larger PPT generator, on its own it materially under-delivers relative to the declared primary purpose. There are no obvious unrelated malicious capabilities, but the implementation shown is only an image-generation module, not a PowerPoint generation pipeline.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description promises a full presentation-generation capability centered on styled slide rendering, image generation, template mimicry, and production of final deliverables like HTML and .pptx files. The actual code shown does none of that. It only reads a markdown slide plan, parses frontmatter and slide headings, assigns page/layout metadata, and emits a JSON plan file. This is a supporting preprocessing utility at most, not the described end-user PPT generation system. Therefore the description does not accurately represent the behavior of this code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description presents a full presentation-generation skill centered on gpt-image-2 image synthesis and stylized PPT creation. The supplied code chunk instead performs a narrow preprocessing/rendering task: taking an existing PPTX file, converting it to PDF, and rasterizing each page to PNG images. While this could support a template-clone pipeline, the chunk itself does not generate slides, mimic templates in output decks, invoke any OpenAI model, or create HTML/PPT deliverables described in the declaration. Therefore the actual behavior is materially different from the declared primary purpose.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 83% confidence
- Finding
The skill explicitly instructs users to place API keys in .env files and describes runtime loading of credentials from several skill-related filesystem locations. In a skill that also uses shell, file access, and network operations, handling secrets this way increases the risk of accidental disclosure, misuse by downstream scripts, or unintended transmission to external endpoints if execution is not tightly bounded.
- Content
bash install_as_skill.sh --target claude # Claude Code
或
bash install_as_skill.sh --target codex # Codex
仅当你走 API 直连模式时，再编辑对应目录下的 .env 填入 API_KEY
text ## 必需的环境变量
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill instructs that all text 'must' be in Simplified Chinese and explicitly forbids English except proper nouns. This is a language-policy constraint imposed by default, with no user choice or opt-in, which is a natural-language policy violation.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md default_prompt: "Make me a 5-slide deck about [topic] using gpt-image2-ppt; pick a fitting style from styles/." # Trust surface (what the user agrees to when installing this skill): # - Reads scoped .env files only (skill dir, ~/.claude/skills/.../, ~/skills/.../) # and never walks parent project directories. # - Hits exactly the OPENAI_BASE_URL endpoint you set, plus optional # VISION_BASE_URL endpoint you set (template-clone mode only).
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md default_prompt: "Make me a 5-slide deck about [topic] using gpt-image2-ppt; pick a fitting style from styles/." # Trust surface (what the user agrees to when installing this skill): # - Reads scoped .env files only (skill dir, ~/.claude/skills/.../, ~/skills/.../) # and never walks parent project directories. # - Hits exactly the OPENAI_BASE_URL endpoint you set, plus optional # VISION_BASE_URL endpoint you set (template-clone mode only).
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
yaml default_prompt: "Make me a 5-slide deck about [topic] using gpt-image2-ppt; pick a fitting style from styles/." # Trust surface (what the user agrees to when installing this skill): # - Reads scoped .env files only (skill dir, ~/.claude/skills/.../, ~/skills/.../) # and never walks parent project directories. # - Hits exactly the OPENAI_BASE_URL endpoint you set, plus optional # VISION_BASE_URL endpoint you set (template-clone mode only).
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md default_prompt: "Make me a 5-slide deck about [topic] using gpt-image2-ppt; pick a fitting style from styles/." # Trust surface (what the user agrees to when installing this skill): # - Reads scoped .env files only (skill dir, ~/.claude/skills/.../, ~/skills/.../) # and never walks parent project directories. # - Hits exactly the OPENAI_BASE_URL endpoint you set, plus optional # VISION_BASE_URL endpoint you set (template-clone mode only).
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md default_prompt: "Make me a 5-slide deck about [topic] using gpt-image2-ppt; pick a fitting style from styles/." # Trust surface (what the user agrees to when installing this skill): # - Reads scoped .env files only (skill dir, ~/.claude/skills/.../, ~/skills/.../) # and never walks parent project directories. # - Hits exactly the OPENAI_BASE_URL endpoint you set, plus optional # VISION_BASE_URL endpoint you set (template-clone mode only).
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python default_prompt: "Make me a 5-slide deck about [topic] using gpt-image2-ppt; pick a fitting style from styles/." # Trust surface (what the user agrees to when installing this skill): # - Reads scoped .env files only (skill dir, ~/.claude/skills/.../, ~/skills/.../) # and never walks parent project directories. # - Hits exactly the OPENAI_BASE_URL endpoint you set, plus optional # VISION_BASE_URL endpoint you set (template-clone mode only).
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python default_prompt: "Make me a 5-slide deck about [topic] using gpt-image2-ppt; pick a fitting style from styles/." # Trust surface (what the user agrees to when installing this skill): # - Reads scoped .env files only (skill dir, ~/.claude/skills/.../, ~/skills/.../) # and never walks parent project directories. # - Hits exactly the OPENAI_BASE_URL endpoint you set, plus optional # VISION_BASE_URL endpoint you set (template-clone mode only).
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python default_prompt: "Make me a 5-slide deck about [topic] using gpt-image2-ppt; pick a fitting style from styles/." # Trust surface (what the user agrees to when installing this skill): # - Reads scoped .env files only (skill dir, ~/.claude/skills/.../, ~/skills/.../) # and never walks parent project directories. # - Hits exactly the OPENAI_BASE_URL endpoint you set, plus optional # VISION_BASE_URL endpoint you set (template-clone mode only).
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python default_prompt: "Make me a 5-slide deck about [topic] using gpt-image2-ppt; pick a fitting style from styles/." # Trust surface (what the user agrees to when installing this skill): # - Reads scoped .env files only (skill dir, ~/.claude/skills/.../, ~/skills/.../) # and never walks parent project directories. # - Hits exactly the OPENAI_BASE_URL endpoint you set, plus optional # VISION_BASE_URL endpoint you set (template-clone mode only).
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh default_prompt: "Make me a 5-slide deck about [topic] using gpt-image2-ppt; pick a fitting style from styles/." # Trust surface (what the user agrees to when installing this skill): # - Reads scoped .env files only (skill dir, ~/.claude/skills/.../, ~/skills/.../) # and never walks parent project directories. # - Hits exactly the OPENAI_BASE_URL endpoint you set, plus optional # VISION_BASE_URL endpoint you set (template-clone mode only).
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh default_prompt: "Make me a 5-slide deck about [topic] using gpt-image2-ppt; pick a fitting style from styles/." # Trust surface (what the user agrees to when installing this skill): # - Reads scoped .env files only (skill dir, ~/.claude/skills/.../, ~/skills/.../) # and never walks parent project directories. # - Hits exactly the OPENAI_BASE_URL endpoint you set, plus optional # VISION_BASE_URL endpoint you set (template-clone mode only).
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh default_prompt: "Make me a 5-slide deck about [topic] using gpt-image2-ppt; pick a fitting style from styles/." # Trust surface (what the user agrees to when installing this skill): # - Reads scoped .env files only (skill dir, ~/.claude/skills/.../, ~/skills/.../) # and never walks parent project directories. # - Hits exactly the OPENAI_BASE_URL endpoint you set, plus optional # VISION_BASE_URL endpoint you set (template-clone mode only).
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python default_prompt: "Make me a 5-slide deck about [topic] using gpt-image2-ppt; pick a fitting style from styles/." # Trust surface (what the user agrees to when installing this skill): # - Reads scoped .env files only (skill dir, ~/.claude/skills/.../, ~/skills/.../) # and never walks parent project directories. # - Hits exactly the OPENAI_BASE_URL endpoint you set, plus optional # VISION_BASE_URL endpoint you set (template-clone mode only).
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python default_prompt: "Make me a 5-slide deck about [topic] using gpt-image2-ppt; pick a fitting style from styles/." # Trust surface (what the user agrees to when installing this skill): # - Reads scoped .env files only (skill dir, ~/.claude/skills/.../, ~/skills/.../) # and never walks parent project directories. # - Hits exactly the OPENAI_BASE_URL endpoint you set, plus optional # VISION_BASE_URL endpoint you set (template-clone mode only).
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python default_prompt: "Make me a 5-slide deck about [topic] using gpt-image2-ppt; pick a fitting style from styles/." # Trust surface (what the user agrees to when installing this skill): # - Reads scoped .env files only (skill dir, ~/.claude/skills/.../, ~/skills/.../) # and never walks parent project directories. # - Hits exactly the OPENAI_BASE_URL endpoint you set, plus optional # VISION_BASE_URL endpoint you set (template-clone mode only).
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python default_prompt: "Make me a 5-slide deck about [topic] using gpt-image2-ppt; pick a fitting style from styles/." # Trust surface (what the user agrees to when installing this skill): # - Reads scoped .env files only (skill dir, ~/.claude/skills/.../, ~/skills/.../) # and never walks parent project directories. # - Hits exactly the OPENAI_BASE_URL endpoint you set, plus optional # VISION_BASE_URL endpoint you set (template-clone mode only).
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python default_prompt: "Make me a 5-slide deck about [topic] using gpt-image2-ppt; pick a fitting style from styles/." # Trust surface (what the user agrees to when installing this skill): # - Reads scoped .env files only (skill dir, ~/.claude/skills/.../, ~/skills/.../) # and never walks parent project directories. # - Hits exactly the OPENAI_BASE_URL endpoint you set, plus optional # VISION_BASE_URL endpoint you set (template-clone mode only).