Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent PowerPoint generator, but it should be reviewed because it can route user presentation content to external image-generation services without a clear privacy or consent checkpoint.
Install only if you are comfortable with this skill handling presentation source material and optional image-generation services. Before using it with confidential, regulated, customer, or internal business content, confirm which image provider will be used, avoid pasting secrets into prompts or files, and prefer a local or approved-provider workflow. Do not use the watermark-removal/cutout helper except on assets you own or are authorized to modify.
The README states the skill will auto-trigger whenever a user asks to make a PPT and wants an editable PowerPoint, which is a broad activation condition that can match many normal requests. In an agent environment, overly broad auto-activation can cause unintended invocation, unexpected file handling, or routing user content into this skill when the user did not explicitly choose it.
The skill’s trigger description is extremely broad, covering nearly any request related to presentations, training decks, briefings, or content-to-slides transformation. This can cause the skill to activate in situations where a more specialized or safer skill should be used, increasing the chance of unintended file handling, external tool usage, or execution of complex workflows on loosely related user requests.
The document describes enabling a cloud image-generation path with secret keys but does not disclose that prompts and possibly user-provided materials may be transmitted to an external service. In this workflow, inputs can include emails, business metrics, and internal presentation content, so missing a data-transfer warning increases the risk of unintentional disclosure of sensitive business information.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
# AI PPT Designer
### 千题千境 · Custom AI PPTX Generator
**Create custom, content-driven PowerPoint presentations — not template-based slides.**
AI PPT Designer turns your notes, documents, emails, spreadsheets, images, or ideas into a professionally structured and visually designed PowerPoint presentation.
This plain-text prompt includes call-to-action language such as "开始对话" and input guidance like "给我一个标题 + 你的素材" without defining when the skill should or should not activate. Those phrases are generic enough to overlap with ordinary collaboration requests, and the file provides no negative examples or explicit trigger scope to narrow invocation.
The skill recommends sending content to external image-generation services such as Midjourney, DALL·E, and 即梦 as a fallback, but it does not warn that user-provided text, designs, branding, business data, or internal project details may be transmitted to third-party providers. Because this workflow is built around customer presentation materials, the omitted privacy warning materially increases the chance of unauthorized disclosure of confidential or regulated information.
The document includes guidance to erase watermark regions during image cutout without any warning about copyright, licensing, or platform-term restrictions. Even if intended for cleanup of AI-generated artifacts, watermark-removal instructions can facilitate rights circumvention and misuse of protected content, especially when packaged into an operational skill.
The line states that intermediate iterations should not enter long-term memory, and only the final package should be stored in the skill itself. This implies a workflow where user-provided content from the interaction may be persisted into lasting memory/artifacts, creating a natural-language data retention and potential leakage risk even though it is framed as process guidance.
The inline documentation states that existing outputs are never overwritten due to auto version bumping. However, that safeguard is only used later for the verification sheet; the main processed assets are written with a fixed path via rgba.save(os.path.join(OUT, name + ".png")), which will overwrite existing files of the same name.
The file is predominantly written in Chinese with some English labels and headings, but it does not state that users can choose their preferred language. Under the stated policy, forcing or assuming a language without opt-in can be a natural-language policy issue unless the locale constraint is documented and justified.
The fallback trigger uses very vague dissatisfaction phrases like 'bad', 'not good', or 'not very satisfied', which are common in ordinary iterative feedback. This can prematurely switch the workflow away from normal refinement into an external prompt-delivery fallback path, causing unexpected behavior, user confusion, and possible unnecessary use of external tools or handoff steps.
The file is primarily Chinese-language guidance, but the slide prompts hard-code English presentation text such as "SSC Automation Project", "Next Steps", and roadmap labels like "Identify" and "Evaluate". Because the file does not state that English output is required or optional, it appears to impose a language choice without user opt-in.
The document instructs operators to use TENCENTCLOUD_SECRET_ID/KEY for cloud image generation but does not warn that these are sensitive credentials that must be protected and never embedded in prompts, logs, scripts, or artifacts. In a skill context, this omission can lead to accidental secret disclosure or unsafe handling by downstream automation and users.
The only natural-language instruction in the file is a Chinese docstring, which imposes a specific language/locale context without any visible opt-in or explanation that the skill is region-specific. The policy for this audit requires flagging language or locale constraints unless they are optional or clearly justified.
With no manifest available, the skill's purpose is unknown, and this file appears to be a local PPTX test generator. Reading QIANTI_OUT from the environment introduces an extra capability—external runtime-controlled file destination selection—that is not justified by any stated skill purpose in the provided context.
The heading includes Chinese text ('千题千境') alongside English, but the document does not explain whether the skill may present outputs, prompts, or UX elements in Chinese or allow the user to choose a language. Under the language/locale policy, imposing or implying a language choice without opt-in can be a policy concern.
Across the slide prompts, visible content is prescribed in English terms such as "SSC Automation Project," "Next Steps," and roadmap labels, while the surrounding instructions are in Chinese. This creates a fixed bilingual/English presentation style without stating that the user can choose another language or locale.
The document references Tencent Cloud secret variables for image generation but does not warn users not to paste secrets into prompts, logs, or shared artifacts, nor does it explain where those credentials may be transmitted or stored. In a workflow document intended as a reusable skill knowledge base, this omission can lead operators to handle cloud credentials unsafely and expose them through tooling, scripts, or collaboration channels.
The comment states 'Never overwrite existing artifacts,' which implies a conservative output policy. However, beyond the primary output file, the script also unconditionally writes a second PPTX under a separate build path later in main, creating an extra artifact not suggested by the nearby documentation.
The top-level docstring is written entirely in Chinese and provides no indication that language choice is optional or contextually required. Per the policy, forcing a specific language without user opt-in can be a natural-language locale violation.