Security audit

Frontend Slides

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to do what it says: make or convert slide decks locally, with some normal privacy and dependency considerations to keep in mind.

Install only if you are comfortable with the agent reading the presentation files and image folders you provide, creating local output/assets, optionally storing edits in browser localStorage, and installing Pillow or python-pptx if needed. For confidential decks, avoid enabling inline editing on shared browsers, review extracted assets/notes, and prefer pinned dependencies or a sandboxed Python environment.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:186
Finding: Unpinned Runtime Installation of Third-Party Python Packages
Content: View full analysis
Remediation: View remediation
--hash=sha256: python-pptx== --hash=sha256: ``` 2. Install dependencies with hash verification: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Pin and review all transitive dependencies rather than only the two direct packages. 4. Perform installations inside a dedicated virtual environment or disposable sandbox with minimal filesystem and network permissions. 5. Require explicit user approval before installing missing software at runtime. 6. Configure `pip` to use a trusted, controlled index and disable unexpected extra indexes where practical. 7. Regularly update pinned versions through a controlled dependency-review process that includes vulnerability and provenance checks. ]]>

other

Note

Location: SKILL.md:198
Finding: Generated Presentations May Load Undisclosed External Font Resources
Content: View full analysis
``` `references/STYLE_PRESETS.md:448-459`: ```markdown | Preset | Display Font | Body Font | Source | |--------|--------------|-----------|--------| | Bold Signal | Archivo Black | Space Grotesk | Google | | Electric Studio | Manrope | Manrope | Google | | Creative Voltage | Syne | Space Mono | Google | | Dark Botanical | Cormorant | IBM Plex Sans | Google | | Notebook Tabs | Bodoni Moda | DM Sans | Google | | Pastel Geometry | Plus Jakarta Sans | Plus Jakarta Sans | Google | | Split Pastel | Outfit | Outfit | Google | | Vintage Editorial | Fraunces | Work Sans | Google | | Neon Cyber | Clash Display | Satoshi | Fontshare | | Terminal Green | JetBrains Mono | JetBrains Mono | JetBrains | ``` ### Technical Analysis The Skill describes generated files as self-contained and offline-capable while its HTML architecture explicitly suggests obtaining fonts through external providers. The style reference reinforces this behavior by assigning fonts to Google, Fontshare, and JetBrains sources. If the generated HTML uses remote stylesheet or font URLs, opening the presentation causes a browser to contact third-party infrastructure. Such requests can disclose ordinary network metadata, including the recipient's IP address, browser user-agent, request timing, and potentially referrer information, depending on browser and referrer-policy behavior. Remote resources also weaken reproducibility. Typ ...[truncated 1433 chars]
Remediation: View remediation
``` 6. Reconcile the documentation with actual behavior. Reserve “self-contained” and “works offline” for outputs that contain no external resource references. 7. Add a delivery check that scans generated HTML for `http://`, `https://`, protocol-relative URLs, and remote CSS imports before declaring the artifact offline-capable. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (14)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The example trigger phrase is broad enough to match many ordinary user presentation requests, which can cause the skill to activate in situations beyond the author's likely intent. In an agent environment, overbroad triggering increases the chance the skill is selected unnecessarily, expanding its influence over user workflows and potentially routing unrelated content into HTML/presentation generation paths.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The example trigger phrase "Создай pitch deck для моего AI-стартапа" is broad and maps to a very common user request, which can cause the skill to activate in situations beyond the user's explicit intent. In an agent ecosystem, overly broad triggers increase the chance of unintended invocation, exposing user content or steering workflows into this skill when a more appropriate or safer skill should have been used.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The README mentions inline browser editing with automatic save to localStorage, but it does not prominently disclose the privacy and persistence implications of storing slide content in the browser. This can expose sensitive presentation text to other users of the same browser profile or leave confidential content behind on shared or managed devices.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The PPT conversion flow extracts embedded images and speaker notes to disk, which can expose sensitive presentation content in plaintext or reusable asset files without warning the user. In many real-world decks, notes and images contain confidential strategy, customer data, or internal commentary, so silent extraction increases privacy and data-handling risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instruction to delete .tmp-slide-previews/ performs a filesystem-destructive action without explicit confirmation or a safety check that the path is the expected temporary directory. In an agent context, any deletion step is risky because a misresolved path, symlink, or user surprise could lead to unintended data loss.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: This README advertises converting PowerPoint files into web presentations and gives an example invocation, but it does not disclose that the skill will access and process user files. For markdown files, the rule asks for warnings when behavior could affect user data or privacy; file-content processing is user-data relevant and no warning is present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: Le contenu du README est entièrement en français, mais il ne précise pas en tête de document qu’il s’agit d’une version localisée ou qu’un choix de langue est laissé à l’utilisateur. Même si des liens vers d’autres langues apparaissent plus loin, la présentation initiale peut être interprétée comme une contrainte implicite de langue plutôt qu’un choix explicite.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: Natural-language policy violations apply to all file types, including markdown. The document itself is in Italian, yet the language selector only offers other languages and not Italian, which can be interpreted as an inconsistent locale policy or forced fallback without explicit opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: This is a markdown file, so missing user-facing warnings about behaviors affecting user data or privacy are in scope. The feature list and usage examples mention converting a user's .pptx file, but there is no disclosure about handling document contents, metadata, or any privacy implications of processing uploaded presentations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The README states that the agent will open the generated presentation in the user's browser, which is a system-affecting action, but it does not clearly disclose that this action will be performed automatically or recommend asking for confirmation first. In the context of a skill that generates HTML with inline JavaScript, auto-opening content in a browser increases risk because it may execute active content immediately and surprise the user.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The README states that PPT conversion preserves all images and content, but it does not clearly warn users that the skill will read and process the full contents of any uploaded PowerPoint, including embedded images and potentially sensitive business material. In a presentation-conversion skill this behavior is expected, but the lack of explicit disclosure can still lead to accidental exposure of confidential data if users do not realize the scope of processing.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill directs the agent to generate preview HTML files in .tmp-slide-previews/, which modifies the user's filesystem. Although later steps mention telling the user output paths, there is no upfront warning that the skill will create temporary and output files as part of operation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill's template forces the generated presentation to use English as its document language, regardless of the user's preferred language or the source presentation language. This is a natural-language locale constraint without opt-in or explanation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.