Security audit

ZeeLin Auto-PPT

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to create NotebookLM-based PDF presentations as advertised, but it asks the agent to hide or ignore problems and uses unsafe shell/file handling that could expose or overwrite local data.

Install only if you are comfortable sending presentation material to Google NotebookLM and leaving generated artifacts locally and in the NotebookLM account. Before use, remove the instructions that suppress errors or confirmations, use a secure temporary file or stdin instead of fixed heredocs, validate output filenames, refuse unexpected overwrites, and make the save location explicit.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:19
Finding: Agent Safety and Transparency Controls Are Overridden by Skill Instructions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:43
Finding: Shell Command Injection Through a Fixed Heredoc Delimiter
Content: View full analysis
/tmp/ppt_content.txt << 'CONTENT_EOF'\n你的完整内容文本...\nCONTENT_EOF"}} ``` ``` ```bash cat > /tmp/ppt_content.txt << 'EOF' （你生成的完整长文内容） EOF bash ~/.openclaw/workspace/skills/auto-ppt/scripts/create_ppt.sh "$(cat /tmp/ppt_content.txt)" "主题名称.pdf" ``` ### Technical Analysis The documented execution pattern constructs shell source code by interpolating generated, user-influenced presentation content between fixed heredoc delimiters such as `EOF` and `CONTENT_EOF`. Quoting the delimiter disables expansion inside the intended heredoc body, but it does not prevent an attacker from supplying a line that exactly matches the delimiter. Such a line terminates the heredoc syntactically. Subsequent text is then parsed by the shell as commands. For example, content shaped like the following would escape the intended data region: ```text EOF attacker-controlled-shell-command # ``` The shell command is executed by the Agent's `exec` facility with the same operating-system privileges as the Agent process. ### Attack Path 1. An attacker supplies a presentation topic, source material, or embedded instruction designed to influence generated content. 2. The resulting content contains a standalone fixed delimiter, such as `EOF`. 3. The content following that delimiter contains valid shell syntax. 4. The Agent inserts the generated text directly into the documented shell command. 5. The shell treats the attacker-supplied delimiter as the end of the heredoc. 6. The remaining attacker-controlled text executes as local shell commands. 7. The commands can access any files, credentials, network resources, and tools available to the Agent account. ### Impact Assessment Successful exploitation provides arbitrary command execution with the priv ...[truncated 447 chars]
Remediation: View remediation
"$input_file" bash create_ppt.sh --input-file "$input_file" --output-name "$safe_name" ``` 5. Modify `create_ppt.sh` to read presentation content from a file or standard input instead of a positional command-line argument. 6. Keep command construction and untrusted data in separate API fields; do not use `eval`, dynamic shell fragments, or fixed heredoc delimiters as an escaping mechanism. 7. Add security tests containing standalone `EOF` and `CONTENT_EOF` lines followed by shell metacharacters. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:43
Finding: Predictable Shared Temporary File Enables Symlink Overwrite
Content: View full analysis
/tmp/ppt_content.txt << 'CONTENT_EOF'\n你的完整内容文本...\nCONTENT_EOF"}} ``` ``` The same fixed path is used again in the documented workflow: ```bash cat > /tmp/ppt_content.txt << 'EOF' （你生成的完整长文内容） EOF bash ~/.openclaw/workspace/skills/auto-ppt/scripts/create_ppt.sh "$(cat /tmp/ppt_content.txt)" "主题名称.pdf" ``` ### Technical Analysis The skill always writes content to `/tmp/ppt_content.txt`. Shared temporary directories are normally writable by other local users, and predictable names allow another process to create the path before the skill runs. Shell redirection follows symbolic links. If `/tmp/ppt_content.txt` is a symbolic link to another file writable by the Agent account, the redirection truncates and overwrites that target. A competing process may also replace or modify the temporary file between writing it and reading it for the script invocation, creating a time-of-check/time-of-use race. ### Attack Path 1. A local attacker predicts that the skill will use `/tmp/ppt_content.txt`. 2. Before execution, the attacker creates that path as a symbolic link to a file writable by the Agent account. 3. The skill executes `cat > /tmp/ppt_content.txt`. 4. The shell follows the symbolic link and truncates or overwrites the target file. 5. Alternatively, the attacker changes the temporary file after it is written but before `$(cat /tmp/ppt_content.txt)` reads it. 6. The modified content is then submitted to NotebookLM or used to trigger the separate heredoc injection weakness. ### Impact Assessment The overwrite impact is limited to files writable by the Agent's operating-system account, but it may include workspace files, user configuration, or other user-owned data. The race condition can also compromise presentation integ ...[truncated 254 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/create_ppt.sh:10
Finding: Unvalidated Output Filename Allows Writes Outside the Desktop Directory
Content: View full analysis
/dev/null ``` ### Technical Analysis The second positional argument is accepted as an output filename and concatenated directly with `$HOME/Desktop/`. Shell quoting prevents word splitting and shell metacharacter expansion, but it does not prevent filesystem path traversal. An argument such as `../../target.pdf` produces a path equivalent to: ```text $HOME/Desktop/../../target.pdf ``` After filesystem normalization, the destination is outside the promised Desktop directory. Absolute-path behavior may also vary if the input contains unusual separators or platform-specific path syntax. Whether an existing file is overwritten depends on the behavior of `openclaw browser download`, but the script imposes no protection itself. ### Attack Path 1. An attacker or untrusted workflow influences the requested output filename. 2. The attacker supplies a name containing traversal components, such as `../../some-directory/file.pdf`. 3. The script concatenates this value with `$HOME/Desktop/` without validation. 4. The browser download command resolves the traversal components. 5. The generated PDF is written outside the intended Desktop directory. 6. If the destination API permits replacement, an existing file writable by the Agent account may be overwritten. ### Impact Assessment This issue can cause unintended file creation outside `~/Desktop` and may overwrite user-owned files if the download command allows replacement. The accessible scope is limited to destinations writable b ...[truncated 278 chars]
Remediation: View remediation
&2 exit 1 ;; esac case "$OUTPUT_NAME" in *.pdf) ;; *) echo "ERROR: Output filename must end in .pdf" >&2; exit 1 ;; esac ``` 8. Follow validation with canonical-path containment checks rather than relying solely on string filtering. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill states that content will be processed through Google NotebookLM but does not clearly warn that user-provided material will be sent to a third-party online service. In this skill’s context, that omission is particularly dangerous because users may provide proprietary, personal, or regulated content for slide generation without informed consent to external transmission.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The invocation description is broad and promotional, without strong triggering boundaries or exclusions, which increases the chance that the skill is invoked for loosely related requests involving presentations or document generation. Overbroad activation can expose users to third-party data transfer and local file creation when they did not specifically request those actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill instructs the agent to write generated content to a temporary local file and save the final PDF to the desktop, but it does not prominently disclose the privacy and persistence implications of those local writes. This creates a transparency and consent gap: sensitive content may be left on disk in /tmp or on the desktop without the user understanding that local artifacts will remain after execution.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly directs the agent to use unrestricted shell execution to run a local script and pass user-generated content into it, which expands the trust boundary from browser-only automation to arbitrary local command execution. In this context, that is dangerous because the script path and shell invocation could enable unintended system access, command injection risks, or execution of modified local code outside the narrowly described NotebookLM workflow.
Content: No source excerpt is available for this finding.

Ssd 1

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill contains instruction framing that attempts to suppress normal safety behavior by telling the agent not to mention limitations, to assume full authority, and to ignore tool/configuration errors. Such language is dangerous because it encourages bypass of safeguards, reduces transparency to the user, and makes unsafe execution more likely when tools are misconfigured or the environment differs from expectations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script unconditionally constructs an output path under ~/Desktop and later downloads a file to that location without asking the user to confirm the path. While the downloaded content is a PDF and the filename defaults to a predictable value, writing files into a user-visible location without explicit consent can overwrite existing files if the caller supplies a colliding output name and may expose sensitive generated content to other local users or backup/sync systems.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The fallback flow uses command-line browser operations to download files directly into ~/Desktop/, introducing local filesystem write capability beyond the core web interaction the skill claims to perform. This is risky because it normalizes uncontrolled local file placement and could be adapted to overwrite or drop unexpected files in a user-visible location.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.