Back to skill

Security audit

kai-slide-creator

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent HTML slide generator, but its generated save feature can silently upload the full edited presentation back to the hosting path, so users should review it before installing.

Install only if you are comfortable reviewing or changing the generated HTML template. In particular, remove or replace the Ctrl/Cmd+S PUT save behavior with local download-only saving before hosting generated decks, and treat optional pip installs as normal third-party code by pinning versions or using a disposable virtual environment. Also note that generated decks include a kai-slide-creator watermark by default.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
references/html-template.md:9
Finding

Mandatory Promotional Watermark Hijacks Generated Output

Content
View full analysis
` + `` + `#notes-panel` with textarea 3. **`SlidePresentation` class** — navigation, dots, keyboard, touch, wheel, BroadcastChannel 4. **`?presenter` branch** — replaces body with notes/timer UI when `?presenter` in URL 5. **`PresentMode` class** — inside the `else` block, before `new PresentMode(...)`. **Never put it inside the `if (presenter)` block** (class is block-scoped; it would be inaccessible in the else branch) 6. **`setupEditor()` call** — edit hotzone + notes panel wired up 7. **`data-notes` on every `
`** — 1–3 sentence speaker note per slide 8. **Preset fidelity metadata** — if PLANNING.md or the workflow selected a preset, honor it exactly and stamp it into HTML as `data-preset="Preset Name"` on `` 9. **Watermark footer** — `
By kai-slide-creator v[version] · [preset-name]
` with CSS: `position: fixed; bottom: 6px; right: 12px; font-size: 9px; color: var(--text-secondary, #999); opacity: 0.35; pointer-events: none; z-index: 1; font-family: system-ui, sans-serif;` and `body.presenting .slide-credit { display: none; }`. Replace `[version]` with the current skill version from SKILL.md frontmatter. Replace `[preset-name]` with the selected style preset name (e.g. `Blue Sky`, `Enterprise Dark`). ``` The corresponding outp ...[truncated 1943 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
references/pptx-extraction.md:7
Finding

Unpinned Third-Party Package Installation in PPTX Conversion Workflow

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
references/html-template.md:843
Finding

Generated Presentation Save Function Performs Unconfirmed Same-Origin PUT

Content
View full analysis
\n' + document.documentElement.outerHTML; const bytes = new TextEncoder().encode(html); fetch(location.pathname, { method: 'PUT', body: bytes, headers: { 'Content-Type': 'text/html' } }).catch(() => { // Fallback: download const a = Object.assign(document.createElement('a'), { href: URL.createObjectURL(new Blob([html], { type: 'text/html' })), download: location.pathname.split('/').pop() || 'presentation.html' }); a.click(); URL.revokeObjectURL(a.href); }); } ``` ### Technical Analysis The canonical HTML template binds Ctrl/Cmd+S to `saveFile()`. That method first serializes the complete current document and submits it through an HTTP `PUT` request to `location.pathname`. A local Blob download is attempted only if the request rejects. The operation does not ask for confirmation, does not verify that the current origin is a trusted editing service, and does not require an explicitly configured save endpoint. Same-origin fetch requests use the browser’s normal same-origin authentication context, subject to the applicable credentials and cookie policies. A successful HTTP response is treated as a successful save even if the endpoint was not intended for document editing. If the server permits authenticated `PUT`, the method can overwrite the served resource. It also transmits all edited slide content and speaker notes to the hosting origin. This behavior is particularly unexpected because the interface presents Ctrl/Cmd+S as a generic save operation and the project describes presentations as self-contained browser files. ### Attack Path 1. A generated presentation is opened from an HTTP or HTTPS ...[truncated 1258 chars]
Remediation
View remediation
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (305)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

声明描述的是一个面向最终用户的演示文稿生成技能,但代码实际功能是检查多个文档文件之间的内容是否同步、是否含有禁用措辞。这属于 materially different primary purpose:代码没有任何 HTML 幻灯片生成、主题应用、演讲模式或展示相关逻辑,反而是一个开发/维护辅助脚本。虽然代码是只读且零依赖,这只是实现细节上的相似点,不能弥补核心能力与用途的明显不一致。因此应判定为描述与行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description describes an end-user presentation-generation skill, but the supplied code only configures pytest by adding a test marker for slow browser-based tests. This is a materially different purpose and does not implement or support the described presentation features in any visible way within this chunk. Therefore, the description does not accurately represent the behavior of the provided code.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description presents the skill as an HTML slideshow/presentation generator focused on design presets and presentation modes. The supplied code chunk does not generate presentations or implement playback/presenter functionality. Instead, it is a developer-facing test harness that installs dependency checks, invokes pytest, and validates HTML files. While testing could be a supporting part of the overall project, this chunk’s primary behavior is materially different from the declared end-user purpose, so this code-description pairing is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description presents the skill as a presentation generator for zero-dependency HTML slide decks with multiple design presets and presentation features. The supplied code does not generate slides or implement presenter/playback functionality. Instead, it is a test module that loads existing HTML demo files and reference templates, parses them, and asserts quality and implementation constraints using pytest and BeautifulSoup. This is a materially different primary purpose: QA/regression validation of presentation artifacts, not presentation creation. While the subject matter is related to HTML presentations, the code's capability is testing and verification, which is undeclared and substantially different from the stated skill behavior.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description is about generating HTML slide decks and presentation features. The supplied code does not generate presentations, render HTML, provide design presets, or implement playback/presenter modes. Instead, it is a test module for a documentation synchronization/checking tool, operating on repository files such as SKILL.md, README.md, and references/workflow.md. This is a materially different primary purpose and includes undeclared capabilities like filesystem fixture setup and subprocess-based validation of docs.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared description presents a presentation-generation skill focused on creating standalone HTML slide decks with design presets and presenter/playback features. The supplied code chunk does not implement presentation creation or UI/runtime features for slides. Instead, it is a pytest integration test for an export pipeline from HTML to PPTX, relying on another skill (kai-html-export), demo files, subprocess calls, and verification libraries. This is a materially different primary purpose and includes undeclared capabilities related to testing and PowerPoint export validation, so the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared description presents a user-facing skill for generating HTML presentations with multiple presets and presenter/playback features. The supplied code does not implement presentation generation or runtime presentation features. Instead, it is a test suite that inspects existing markdown and HTML files for consistency and layout regressions. While these tests may support a presentation generator project, the code chunk’s actual purpose is quality assurance/regression validation, which is materially different from the declared primary purpose.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description promises a presentation-generation skill focused on creating zero-dependency HTML slide decks with multiple design presets and presenter/playback features. However, the actual code chunk only reads markdown files and asserts that they contain specific wording about two planning depths and related templates/demos. This is a materially different primary purpose: documentation/workflow validation for planning modes rather than generating or rendering presentations. No evidence in the code supports the advertised presentation capabilities.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared description presents the skill as a presentation creation tool focused on generating HTML slide decks with design presets and presenter/playback features. However, the supplied code chunk does not generate presentations, manipulate HTML, provide themes, or implement playback/presenter functionality. Its actual purpose is to run repository tests that verify the presence and content of documentation files related to review checklists and workflow phases. This is a materially different primary purpose, so the description does not accurately represent the code shown.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description describes a presentation-generation skill focused on producing HTML slide decks with design presets and presenter features. The supplied code chunk instead contains automated tests for terminal console symbol rendering behavior under different encodings. Its primary purpose is validation of CLI/terminal output compatibility, not generating presentations or HTML content. This is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding

The declared purpose describes a presentation-generation skill, but the supplied code does not generate HTML presentations, implement design presets, or provide playback/presenter features. Instead, it performs repository tests that inspect documentation files and verify that certain deployment/share-related content and scripts are absent. This is a materially different primary purpose from the declared description, so it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description presents a content-generation skill for creating standalone HTML slide decks with multiple design presets and presentation modes. The actual code does not generate slides or provide design/style exploration or presenter/playback functionality. Instead, it is a developer-facing validator script used to check whether an already-generated HTML presentation meets certain standards. This is a materially different primary purpose. Additionally, the script explicitly depends on beautifulsoup4, which conflicts with the stated zero-dependency positioning if applied to the supplied code chunk. Therefore, the code chunk does not accurately represent the declared skill behavior.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · demos/aurora-mesh-en.html (reported line 484)May include surrounding context.

html
<div id="edit-badge">EDIT MODE · Ctrl+S to save</div>
<div id="hotzone"></div>

<!-- SLIDE 1: Cover -->
<section class="slide" id="s0">
  <div class="content" style="text-align:center;">
    <div class="reveal" style="margin-bottom: clamp(16px,2.5vw,28px);">

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · demos/aurora-mesh-en.html (reported line 594)May include surrounding context.

html
</div>
</section>

<!-- SLIDE 4: 19 Presets -->
<section class="slide" id="s3">
  <div class="content">
    <div class="reveal">

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · demos/aurora-mesh-en.html (reported line 666)May include surrounding context.

html
</div>
</section>

<!-- SLIDE 6: Features -->
<section class="slide" id="s5">
  <div class="content">
    <div class="reveal">

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · demos/aurora-mesh-en.html (reported line 728)May include surrounding context.

html
</div>
</section>

<!-- SLIDE 8: Get Started -->
<section class="slide" id="s7">
  <div class="content" style="text-align:center;">
    <div class="reveal">

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · demos/enterprise-dark-en.html (reported line 759)May include surrounding context.

html
</div>
</section>

<!-- SLIDE 8: Get Started -->
<section class="slide" id="s7">
  <div class="content" style="text-align:center;">
    <div class="reveal">

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · demos/aurora-mesh-zh.html (reported line 484)May include surrounding context.

html
<div id="edit-badge">EDIT MODE · Ctrl+S to save</div>
<div id="hotzone"></div>

<!-- SLIDE 1: Cover -->
<slides>
<section class="slide" id="s0">
  <div class="content" style="text-align:center;">

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · demos/blue-sky-en.html (reported line 417)May include surrounding context.

html
<div id="stage">
<div id="track">

  <!-- ══════════════════════════════════════════
       01 — COVER
       ══════════════════════════════════════════ -->
  <section class="slide cover" style="overflow:hidden;" data-notes="Welcome! slide-creator generates polished HTML presentations from a prompt — zero dependencies, browser-native. 21 themes, single file output.">

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · demos/blue-sky-en.html (reported line 655)May include surrounding context.

html
</div>
  </section>

  <!-- ══════════════════════════════════════════
       05 — ZERO DEPENDENCIES
       ══════════════════════════════════════════ -->
  <section class="slide" data-notes="Single HTML file: inline CSS, inline JS, no CDN. Works offline, emails as attachment, opens in any browser. PPTX export via /kai-html-export.">

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · demos/blue-sky-zh.html (reported line 417)May include surrounding context.

html
<div id="stage">
<div id="track">

  <!-- ══════════════════════════════════════════
       01 — COVER
       ══════════════════════════════════════════ -->
  <section class="slide cover" style="overflow:hidden;" data-notes="欢迎!slide-creator 从提示词生成精美的 HTML 演示文稿 — 零依赖,浏览器原生。21 个主题,单文件输出。">

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · demos/blue-sky-zh.html (reported line 417)May include surrounding context.

html
<div id="stage">
<div id="track">

  <!-- ══════════════════════════════════════════
       01 — COVER
       ══════════════════════════════════════════ -->
  <section class="slide cover" style="overflow:hidden;" data-notes="欢迎!slide-creator 从提示词生成精美的 HTML 演示文稿 — 零依赖,浏览器原生。21 个主题,单文件输出。">

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The saveFile() function performs a fetch with method PUT to location.pathname, meaning the page can attempt to write back to whatever server path served it. If this demo is hosted on an origin that accepts PUT or is fronted by permissive middleware, a user-triggered action could overwrite hosted content or be abused as an unexpected content modification primitive.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · demos/bold-signal-en.html (reported line 633)May include surrounding context.

html
<button id="edit-toggle">Edit</button>
<div id="save-indicator">SAVED</div>

<!-- SLIDE 1: Cover -->
<section class="slide" id="slide-1">
  <div class="corner-accent"></div>
  <div class="big-num-bg">SC</div>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · demos/bold-signal-en.html (reported line 705)May include surrounding context.

html
</div>
</section>

<!-- SLIDE 4: Presets -->
<section class="slide" id="slide-4">
  <span class="slide-num">04</span>
  <span class="breadcrumb">04 / 08</span>

Static analysis

No suspicious patterns detected.