PPTX to Image Converter

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 8:27 AM UTC
• Version: 1.0.0

Overview

This skill appears to be a straightforward PowerPoint-to-image converter, with some normal dependency and Office-document safety cautions.

Install this only if you are comfortable using a Windows-only converter that automates Microsoft PowerPoint. Prefer a virtual environment, pin pywin32 before use, and convert only trusted presentations unless you can isolate the run in a low-privilege or disposable environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: package.json:11

Finding

Unpinned pywin32 Dependency Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: package.json:11, README.md:7-9, SKILL.md:59-62
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

package.json:11:

json

"requirements": ["pywin32"],

The corresponding installation command in README.md:7-9 and SKILL.md:59-62 is:

bash

pip install pywin32

Technical Analysis

The project instructs users to install pywin32 without specifying a reviewed version or validating its package integrity. Consequently, installation resolves to whichever release is selected by the package index at installation time.

The dependency name is consistent with the project's documented Windows COM functionality, and no suspicious alternative package repository or typosquatted name was found. Nevertheless, the absence of version and hash constraints makes builds non-reproducible and allows upstream package changes to enter the execution environment without project-level review.

Python packages and their installation mechanisms can execute code with the permissions of the user performing the installation. Therefore, compromise of the upstream package, release process, package-index account, or dependency delivery channel could result in arbitrary code execution.

Attack Path

1. An attacker compromises the upstream package distribution process or publishes a malicious release through a compromised maintainer account.
2. A user follows the documented pip install pywin32 instruction.
3. pip resolves and downloads the uncontrolled current release.
4. Malicious package code executes during installation or when win32com.client is imported.
5. The payload gains the permissions of the user running the installation or converter.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the installing user's privileges. Depending on those privileges, the attacker could access ...[truncated 320 chars]

Remediation

View remediation

Remediation Suggestions

1. Add a dedicated requirements.txt containing a reviewed, exact version:

   text

   pywin32==REVIEWED_VERSION
   

2. Generate and record a verified SHA-256 hash for the approved distribution:

   text

   pywin32==REVIEWED_VERSION --hash=sha256:VERIFIED_HASH
   

3. Require hash validation during installation:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

4. Update README.md and SKILL.md so users install from the locked requirements file rather than resolving the latest release.
5. Review dependency updates before changing the pin and use automated vulnerability and provenance monitoring.
6. Install the dependency in a dedicated virtual environment under a non-administrative account.

T09 · Insecure Skill Coding Practices

Warning

• Location: pptx_to_image.py:46

Finding

PowerPoint Documents Are Opened Without Explicitly Disabling Active Content

Content

View full analysis

Vulnerability Details

File Location: pptx_to_image.py:46-47, 71-76
Vulnerability Type: Unsafe processing of potentially untrusted Office documents
Risk Level: Medium

Vulnerable Code

python

if pptx_path.suffix.lower() not in ['.pptx', '.ppt']:
    raise ValueError(f"Unsupported file format: {pptx_path.suffix}")

powerpoint = win32com.client.Dispatch("PowerPoint.Application")
powerpoint.Visible = True

try:
    presentation = powerpoint.Presentations.Open(
        str(pptx_path),
        ReadOnly=True,
        WithWindow=False
    )

The displayed exception text has been translated to English; the executable validation and COM behavior are unchanged from the audited source.

Technical Analysis

Although the project is advertised primarily as a PPTX converter, the input validation also accepts legacy .ppt documents. The supplied file is then opened directly through an installed Microsoft PowerPoint instance.

ReadOnly=True protects against writing changes back to the source document, but it is not an active-content security control. The implementation does not explicitly set Office automation security to force-disable macros before opening the document. Processing therefore depends on the host's existing Microsoft Office security policy and version-specific protections.

Legacy .ppt files provide a broader active-content and parser attack surface than modern .pptx files. Even where macros are blocked by policy, malformed documents may target vulnerabilities in the locally installed PowerPoint parser. This issue is particularly relevant when presentations originate from untrusted users or automated upload workflows.

Attack Path

1. An attacker creates a malicious legacy .ppt document containing active content or data crafted to exploit a vulnerable PowerPoint parser.
2. The attacker provides the document to a user or service that invokes this converter.
3. The extensio ...[truncated 881 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove .ppt support unless it is an explicit requirement:

   python

   if pptx_path.suffix.lower() != ".pptx":
       raise ValueError("Only PPTX input is supported")
   

2. Before opening any presentation, configure Office automation security to force-disable macros using the appropriate Microsoft Office automation security constant.
3. Reject macro-enabled formats such as .pptm, .ppsm, and .potm.
4. Process untrusted documents under a dedicated, non-administrative account with minimal filesystem and network access.
5. Consider isolating PowerPoint conversion in a disposable virtual machine or sandbox.
6. Keep Microsoft Office fully patched and enforce organization-wide policies that block macros from untrusted sources.
7. Validate the actual file type rather than relying solely on the filename extension.
8. Document that conversion of untrusted presentations is unsafe unless the recommended isolation and Office security controls are in place.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README-style skill description is written entirely in Chinese, including usage instructions, warnings, examples, and FAQs. This creates a language/locale constraint without any stated opt-in or alternative language option, which matches the policy-violation category for forced language use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code file contains natural-language instructions, descriptions, and runtime messages exclusively in Chinese. Under the policy, forcing a specific language without opt-in or justification is a natural-language policy violation, and no alternative language option or region-specific rationale is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Error messages, argument help text, progress output, and command descriptions are all presented only in Chinese. Because the skill does not offer localization choice or state a justified locale restriction, this constitutes an ongoing language policy issue across the file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill description and usage instructions are written entirely in Chinese, which imposes a language choice on users without any opt-in or indication that the skill is intended only for a Chinese-speaking audience. Under the stated policy, language constraints should either be optional or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The package description is written only in Chinese, which imposes a specific language choice in user-facing metadata without indicating that the skill is language-specific or offering an alternative locale. This can violate language/locale policy where user-facing skill descriptions should not force a language absent opt-in or documented regional scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.