Security audit

Marp Cli

Security checks for vulnerabilities and agentic risk

Overview

This Marp CLI skill is legitimate and coherent, but some examples could expose slide content or local files if copied without additional safeguards.

Install only if you are comfortable with Marp CLI behavior. Prefer localhost-only server use, avoid HOST=0.0.0.0 unless you intentionally expose the service with firewall/authentication controls, and do not enable --allow-local-files or persistent allowLocalFiles settings when processing untrusted Markdown or assets.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: QUICKSTART.md:279
Finding: Persistent Local-File Access Weakens Marp Conversion Isolation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: EXAMPLES.md:128
Finding: Marp HTTP Server Exposed on All Network Interfaces Without Access Controls
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (12)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · EXAMPLES.md (reported line 381)May include surrounding context.
md
Content for audience.  ---

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · EXAMPLES.md (reported line 535)May include surrounding context.
marp --images png $(PRESENTATION) -o dist/images/

clean: rm -rf dist/

text
## Performance Tips

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The examples document shows a server mode that serves presentation content over HTTP, which expands the skill from local file conversion into network service behavior. In a conversion-focused skill, this can unintentionally encourage users to expose files or generated outputs over a reachable interface without understanding the added attack surface.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The example explicitly binds the server to 0.0.0.0, making it accessible from other hosts on the network. Presenting this without a warning can lead users to expose presentation files or conversion endpoints externally, which is riskier than the skill's core local conversion purpose.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The all-interfaces server example lacks any caution about network accessibility, so users may run it assuming it is a local-only preview command. That omission increases the chance of accidental exposure of presentation content or local development artifacts to other systems on the network.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The examples enable --allow-local-files without explaining that this relaxes local file access restrictions during rendering. If users render untrusted Markdown or HTML-backed slide content, that setting can increase exposure of sensitive local files or broaden the impact of malicious deck content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The configuration example enables allowLocalFiles and allow-local-files without an adjacent warning, normalizing a setting that weakens a documented security boundary intended to block local file access during rendering. If users adopt this sample config broadly, untrusted Markdown or embedded content may gain access to local files during browser-based export flows, increasing risk of inadvertent file disclosure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill documents marp -s ./slides and example URLs but does not warn that server mode exposes a local directory over HTTP, which can unintentionally disclose slide contents or derived outputs to other users on the same network or host. In a skill meant for CLI use, this omission is security-relevant because users may treat the example as safe-by-default and start a local content server without understanding exposure risks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The --allow-local-files option is listed with only a vague parenthetical and no explanation of the security consequences. Enabling local file access during rendering can allow markdown or embedded content to read/include sensitive local resources, making this especially risky when converting untrusted slide decks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The server mode examples show how to expose a slide directory over HTTP but do not clearly warn that the contents become reachable via a web server, which can lead users to unintentionally publish internal presentation files on their local network or forwarded interfaces. In a quickstart document, omission of this warning increases the chance of accidental exposure, especially for users who copy commands without understanding the serving behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README documents marp -s ./presentations and direct access via http://localhost:8080/ plus query-based conversion, but it does not warn that server mode exposes an HTTP service and may make presentation content available to other local users or, depending on bind settings/network configuration, other hosts. In a CLI skill, omitting this context can lead users to run a long-lived service unintentionally and expose sensitive slide content or generated exports.
Content: No source excerpt is available for this finding.

Scope Creep

Low

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content: Scanner excerpt · README.md (reported line 231)May include surrounding context.
md
Use Marp themes from npm packages or custom CSS files. ### Plugin System Extend functionality with Marp plugins. ### CLI Integrations Works well with other text processing tools (Pandoc, etc.)

Static analysis

No suspicious patterns detected.