Awesome Deck Pdf

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:24 AM UTC
• Version: 1.0.7

Overview

This slide-to-PDF skill is coherent, but its install and export workflow has enough local security risk that users should review it before use.

Install only in a trusted project, prefer pinned dependency versions, avoid sudo unless you are intentionally doing system setup, and do not export untrusted HTML or sensitive internal URLs without isolation. Run the exporter in a clean directory or container because it creates and deletes fixed helper paths in the working directory.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/export_pdf.js:153

Finding

Predictable Temporary Directory Is Recursively Deleted Without Ownership Validation

Content

View full analysis

/_pdf_pages` and places data there. On platforms where directory junction behavior permits it, the attacker may attempt to redirect the path to another accessible directory. 3. The user runs `node export_pdf.js`. 4. The initialization code resolves the predictable path and calls `fs.rmSync(imgDir, { recursive: true })`. 5. Existing content is d ...[truncated 507 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/export_pdf.js:111

Finding

Chromium Sandbox Is Unconditionally Disabled While Rendering Input HTML

Content

View full analysis

setTimeout(r, 1500)); ``` ### Technical Analysis The script always starts Chrome with `--no-sandbox` and `--disable-setuid-sandbox`. These switches disable Chromium's primary process-isolation boundary even when the host supports sandboxed execution. The exporter accepts a user-selected HTML path and renders the document with JavaScript enabled. It does not validate the HTML's trust level, intercept outbound requests, disable script execution, or restrict the browser in a separate OS-level sandbox. A crafted deck may therefore execute active web content and initiate network requests. Exploitation beyond ordinary browser behavior would require a suitable Chromium vulnerability, but disabling the sandbox materially increases the impact of a renderer compromise. Disabling the sandbox is not intrinsically required for HTML-to-PDF conversion. It may be necessary in a limited set of container environments, but making it unconditional exceeds minimum privilege for systems where the Chromium sandbox is available. ### Attack Path 1. An attacker supplies or modifies an HTML deck that the victim is asked to export. 2. The victim runs `node export_pdf.js attacker-deck.html`. 3. Puppeteer launches Chromium with both sandbox-disabling switches. 4. The attacker-controlled document is loaded from a `file://` URL with JavaScript enabled. 5. The page executes its active content and can make netw ...[truncated 819 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:45

Finding

Installation Instructions Use Unpinned Executable Dependencies

Content

View full analysis

Remediation

View remediation

pip install python-pptx== ``` - Commit a reviewed `package.json` and lockfile, then direct users to run: ```bash npm ci ``` - Use a Python requirements file with exact versions and verified hashes: ```text python-pptx== \ --hash=sha256: ``` Install it with: ```bash pip install --require-hashes -r requirements.txt ``` - Avoid commands that may cause `npx` to download and execute an undeclared package. Invoke a pinned local binary instead: ```bash npm exec --offline -- puppeteer browsers install chrome ``` - Pin and document the expected browser revision where practical. - Review transitive dependencies, installation scripts, and package provenance before updating pins. - Use automated dependency scanning and controlled update pull requests rather than resolving latest releases during end-user installation. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md

**`export_pdf.js` auto-detects Chrome in this order:**

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.

md

**`export_pdf.js` auto-detects Chrome in this order:**

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.

md

**`export_pdf.js` auto-detects Chrome in this order:**

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 205)May include surrounding context.

md

**`export_pdf.js` auto-detects Chrome in this order:**

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 213)May include surrounding context.

md

**`export_pdf.js` auto-detects Chrome in this order:**

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 235)May include surrounding context.

md

**`export_pdf.js` auto-detects Chrome in this order:**

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrases are very broad and overlap with common user requests for presentations, causing the skill to activate in many routine contexts. Over-broad activation increases attack surface because the skill may initiate network fetching, file parsing, or shell-oriented workflows in situations where the user did not explicitly request those higher-risk behaviors.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill tells the agent to fetch and analyze website URLs but does not require a user-facing notice that external network access will occur or that URL contents may be transmitted to tooling such as Puppeteer. This can lead to privacy surprises, unintended access to internal or sensitive URLs, and possible SSRF-style misuse in agent environments with network reachability.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The skill instructs use of npx puppeteer, which can fetch and execute a package version not explicitly pinned by the skill. In an agent or automated environment, this creates supply-chain risk because behavior may change over time or a compromised upstream release could be executed implicitly.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 85% confidence

Finding

The documented fallback includes sudo apt install chromium-browser, which encourages privileged system modification from within the skill workflow. In agent-assisted or sandboxed environments, prompting for root-level package installation expands blast radius and can normalize unsafe privilege escalation for a non-essential task.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

Option C: install system Chrome first, then run script

macOS: brew install --cask google-chrome

Linux: sudo apt install chromium-browser

npm install puppeteer-core

text

**Do NOT fall back to wkhtmltopdf, pdfkit, weasyprint, or any other tool.**

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The template title and instructions are entirely in Chinese and direct the author to fill the document accordingly, but there is no indication that language selection is optional or limited to a China-specific use case. This creates a natural-language locale policy concern because the skill appears to mandate a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/install.md (reported line 65)May include surrounding context.

Linux

bash

# Puppeteer may need extra Chrome deps
sudo apt-get install -y libx11-xcb1 libxcomposite1 libxcursor1 libxdamage1 \
  libxi6 libxtst6 libnss3 libcups2 libxss1 libxrandr2 libasound2 libatk1.0-0 \
  libgtk-3-0
npm install puppeteer

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The top-of-file documentation states 'Do NOT use page.pdf() directly' and describes screenshot-and-compose as the only method to use. However, the implementation later invokes Puppeteer's PDF generation API via overlayPage.pdf(), which directly contradicts that guidance rather than merely omitting detail.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/export_pdf.js (reported line 103)May include surrounding context.

js

❌ No Chrome/Chromium found. Please install one of the following:

  macOS:   brew install --cask google-chrome
  Linux:   sudo apt install chromium-browser
  npm:     npm install puppeteer   (downloads bundled Chromium)
`);
    process.exit(1);