deep-research-ppt-pro

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:32 AM UTC
• Version: 0.1.0

Overview

This skill is for research-to-PPT generation, but it needs review because it can run privileged system package installs and adds fixed team branding/contact text to generated decks.

Review before installing. Use an isolated environment, do not run the sudo pip or runtime sudo apt-get paths from the skill, provide API keys only if you trust the workflow, and remove or configure the fixed team branding/contact text if you need faithful report-derived output.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:156

Finding

Forced Branding and Promotional Content Injection

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/generate_and_assemble.py:110

Finding

Automatic Privileged Operating-System Package Installation

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: README.md:45

Finding

Unpinned Third-Party Python Dependencies

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (27)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 29)May include surrounding context.

md

desearch-ppt/
├── SKILL.md                          # 主文件（Agent 执行指南）
├── README.md                         # 本文件
├── .env                              # 环境变量配置
├── references/
│   ├── zeelin_api.md                 # ZeeLin API 调用指南
│   ├── slide_structure.md            # PPT 结构与布局规范

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The description advertises a full pipeline that takes any topic and automatically produces a traceable deep research report plus professional PPT/PDF, including external research, source verification, originality generation, and OCR proofreading. The supplied code chunk only covers a later-stage execution script: it consumes an already-prepared list of slide prompts, calls Gemini to generate slide images, optionally OCR-checks rendered text, retries failed images, and assembles PNGs into PPTX/PDF files. While the OCR check and PPT/PDF assembly are consistent with part of the description, the major claimed capabilities—deep research, .gov verification, original idea generation, full report generation, and end-to-end topic-driven automation—are absent from this code. Therefore the declared description materially overstates what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description promises a comprehensive pipeline: topic input to deep research report creation, traceable data validation, original idea generation, image generation, OCR proofreading, and final PPT/PDF production. The supplied code does something much narrower: it accepts an existing Markdown report file and emits a JSON slide outline by parsing headers and selecting sentences. No network access, model/API calls, OCR, image generation, external validation, or presentation rendering are present. The script is explicitly labeled as only '阶段 3：PPT 大纲提炼', which materially differs from the declared end-to-end product. Additionally, despite comments claiming slide text is 100% from the report, the script injects canned cover/end content such as '清新研究团队' and '联系我们获取更多研究报告', showing minor behavior inconsistency within the code itself.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill installs system packages at runtime through apt, which exceeds the expected scope of generating research reports and slide decks. In an agent setting, this expands the trust boundary from file generation to host modification, increasing the chance of privilege abuse, unexpected network access, and environment tampering.

Content

No source excerpt is available for this finding.

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 97% confidence

Finding

The script executes a privileged shell command via os.system to run apt-get update/install with sudo during normal program flow. This grants the skill the ability to modify the host system, trigger package installation side effects, and execute additional shell-chained commands, which is risky for a PPT-generation skill and especially dangerous if run in an automated agent environment.

Content

Scanner excerpt · scripts/generate_and_assemble.py (reported line 120)May include surrounding context.

python

pass
    
    log("  [OCR] 正在安装 Tesseract...")
    os.system("sudo apt-get update -qq && sudo apt-get install -y -qq tesseract-ocr tesseract-ocr-chi-sim")
    return True

def clean_text_for_comparison(text):

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 94% confidence

Finding

The command chains 'apt-get update' and 'apt-get install' with && in a shell string, coupling multiple privileged operations in one execution path. Shell chaining increases fragility and broadens the effect of a single call; in agent environments it is a strong signal of system-modifying behavior beyond the stated task scope.

Content

Scanner excerpt · scripts/generate_and_assemble.py (reported line 120)May include surrounding context.

python

pass
    
    log("  [OCR] 正在安装 Tesseract...")
    os.system("sudo apt-get update -qq && sudo apt-get install -y -qq tesseract-ocr tesseract-ocr-chi-sim")
    return True

def clean_text_for_comparison(text):

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The natural-language instructions and feature descriptions are presented only in Chinese, which effectively forces a specific language for users. The file does not provide an opt-in, alternative language, or justification for a Chinese-only audience, which is a language/locale policy concern under the stated rule.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill advertises and instructs use of environment variables, file read/write, and shell operations, but it does not declare any explicit tool scope or permission boundaries. That makes the effective capability surface broader and less auditable, increasing the risk that an agent executes sensitive shell commands, reads secrets, or writes files beyond what users expect.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The description and heading present the skill as Chinese-language only, and the workflow later requires Chinese text content in prompts, but nowhere offers the user a language or locale choice. This is a natural-language locale policy concern because it imposes a specific language by default rather than documenting an opt-in or justified regional restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The instructions for prompt generation say that all Chinese text content in prompts must be extracted from the final report, which implies the skill enforces Chinese-language slide content. Because no alternative language path or explicit user choice is provided, this creates a locale-policy violation in the natural-language instructions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs installation of system-level packages with sudo/apt-get, expanding its operational scope from document generation into privileged system modification. Privileged package installation can alter the host, introduce supply-chain risk, and violate least-privilege expectations for a content-generation skill.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The explicit use of sudo to run pip install grants root-level execution to package installation, which is dangerous because package setup scripts execute code during install. If a dependency is compromised, mistyped, or substituted, the host could be fully compromised with elevated privileges.

Content

Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.

确保环境中安装了必要的依赖：

bash

sudo pip3 install google-genai pillow fpdf2 python-pptx pytesseract python-Levenshtein
sudo apt-get install -y tesseract-ocr tesseract-ocr-chi-sim

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

Using sudo apt-get from within the skill instructs privileged modification of the operating system. This increases attack surface through package repositories, mirrors, and package post-install scripts, and is disproportionate to the stated document-generation purpose.

Content

Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.

确保环境中安装了必要的依赖：

bash

sudo pip3 install google-genai pillow fpdf2 python-pptx pytesseract python-Levenshtein
sudo apt-get install -y tesseract-ocr tesseract-ocr-chi-sim

5.2 批量生成与 OCR 核验

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Line L046 requires every slide to contain complete Chinese sentences, which is a language-specific requirement stated as mandatory natural-language behavior. The document does not provide user opt-in, language alternatives, or a region-specific justification, so it violates the locale-choice policy.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 51)May include surrounding context.

md

4. 运行：python3 generate_and_assemble.py

依赖安装：
  sudo pip3 install google-genai pillow fpdf2 python-pptx pytesseract python-Levenshtein
  sudo apt-get install -y tesseract-ocr tesseract-ocr-chi-sim

环境变量：

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/generate_and_assemble.py (reported line 20)May include surrounding context.

python

4. 运行：python3 generate_and_assemble.py

依赖安装：
  sudo pip3 install google-genai pillow fpdf2 python-pptx pytesseract python-Levenshtein
  sudo apt-get install -y tesseract-ocr tesseract-ocr-chi-sim

环境变量：

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/generate_and_assemble.py (reported line 21)May include surrounding context.

python

4. 运行：python3 generate_and_assemble.py

依赖安装：
  sudo pip3 install google-genai pillow fpdf2 python-pptx pytesseract python-Levenshtein
  sudo apt-get install -y tesseract-ocr tesseract-ocr-chi-sim

环境变量：

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate_and_assemble.py (reported line 112)May include surrounding context.

python

def ensure_tesseract_installed():
    """确保 Tesseract OCR 及中文语言包已安装"""
    try:
        result = subprocess.run(["tesseract", "--version"], capture_output=True, text=True)
        if result.returncode == 0:
            log("  [OCR] Tesseract 已安装")
            return True

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script performs package installation without a runtime confirmation gate or explicit user consent at the execution point. That means a user invoking a content-generation workflow may unknowingly trigger privileged system changes, which is unsafe and violates least surprise.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The script invokes sudo during runtime, meaning successful execution may depend on elevated privileges and can modify the host OS. In a skill whose purpose is document generation, this privilege requirement is unnecessary and materially raises the blast radius if the script is misused or integrated into an automated execution pipeline.

Content

Scanner excerpt · scripts/generate_and_assemble.py (reported line 120)May include surrounding context.

python

pass
    
    log("  [OCR] 正在安装 Tesseract...")
    os.system("sudo apt-get update -qq && sudo apt-get install -y -qq tesseract-ocr tesseract-ocr-chi-sim")
    return True

def clean_text_for_comparison(text):

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This is a code file, so SQP-3 applies to natural-language strings in docstrings and user-facing text. The header, usage documentation, and operational descriptions are Chinese-only, which can violate language/locale policy when no opt-in or justification is provided.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module documentation explicitly states that every PPT page should come entirely from the report and that no extra information will be added. However, the generated cover slide adds "清新研究团队" and the current year, and the ending slide adds "感谢阅读" and a contact prompt, none of which are derived from the input report.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The docstring says each slide must label where its content comes from in the report. Yet the cover, table of contents, and ending slides are assigned generic values such as "封面", "目录", and "结尾" with excerpts like "章节列表" or "致谢", which are not actual source locations or necessarily present in the report.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/report_to_ppt_outline.py (reported line 180)May include surrounding context.

python

"num": slide_num,
        "layout": "cover",
        "title": report_title,
        "content": ["清新研究团队", f"{__import__('datetime').date.today().year}年"],
        "source_section": "封面",
        "source_text_excerpt": report_title
    })

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script prints examples, status, and success/error messages in Chinese for operators using the tool. Because no alternative locale or user-selectable language is offered, this constitutes a natural-language locale constraint in an all-file-types policy category.

Content

No source excerpt is available for this finding.