ClawHub
Back to skill

Security audit

Pitch Deck V2

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed remote pitch-deck generator, but users should treat the submitted business details and hosted PPTX links as sensitive.

Install only if you are comfortable sending pitch-deck inputs to the external provider. Avoid submitting trade secrets, unreleased financials, customer lists, regulated data, or confidential investor materials unless you have verified the provider's privacy, retention, and download-link access controls.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill asks users to submit detailed startup and business information along with identifiers like sessionId and optional userId, but provides no privacy notice, data minimization guidance, retention policy, or warning that this information is sent to a third-party API. This creates a real data-handling risk because users may disclose confidential fundraising, traction, team, or strategic information without informed consent.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The PPTX generation flow returns a remotely hosted download URL with a 7-day lifetime, but the skill does not warn that generated presentation files are stored on external infrastructure and may be accessible to anyone possessing the link. Because pitch decks often contain confidential financials, strategy, and fundraising details, temporary public hosting materially increases the chance of unintended disclosure.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The spec collects sessionId, timestamp, and optional userId without any stated privacy notice, minimization rationale, or handling constraints. In a user-facing skill, collecting identifiers without transparent disclosure or documented retention/use limitations creates unnecessary privacy risk and can enable tracking or correlation of user activity across requests.

External Transmission

Medium
Category
Data Exfiltration
Content
"status": "success",
  "filename": "TechVenture_AI_Pitch_Deck_20240115.pptx",
  "fileSize": "2.4 MB",
  "downloadUrl": "https://api.mkkpro.com/files/temp/pptx_abc123xyz.pptx",
  "expiresIn": "7 days",
  "generatedAt": "2024-01-15T10:31:30Z"
}
Confidence
90% confidence
Finding
This finding reflects an actual external transmission path: generated PPTX content and related startup data are hosted or served from api.mkkpro.com via a downloadable URL. In this skill context, external transmission is expected, but it is still security-relevant because confidential business information is being sent to and retrieved from a third-party service without prominent trust, privacy, or access-control disclosures.

Static analysis

No suspicious patterns detected.