openclaw-slides

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 3:54 AM UTC
• Version: 2.0.0

Overview

This skill is a presentation generator/converter whose file access and optional dependencies mostly match its stated purpose, with some install and privacy caveats users should understand.

Install only if you are comfortable with the agent reading presentation/image files you provide and generating local HTML/assets. Approve optional pip installs only in an environment where unpinned Python packages are acceptable, and avoid remote-font presets or bundle fonts locally if viewer privacy or offline use matters. Use inline editing only if browser localStorage persistence is acceptable for the deck content.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8

Finding

Unpinned Third-Party Python Packages Installed Through pip

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:8-12
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

yaml

install:
  - id: python-pptx
    kind: shell
    label: "Install Python dependencies for PPT conversion (optional — only needed for Mode B)"
    command: "pip install python-pptx Pillow"
    optional: true

Additional installation instructions appear at SKILL.md:199 and SKILL.md:319:

text

Install if needed: `pip install Pillow`

text

Install: `pip install python-pptx`

Technical Analysis

The skill directs the agent to install python-pptx and Pillow from the configured Python package index without pinning versions or verifying package hashes. It provides no lock file, trusted-index restriction, isolated environment requirement, or integrity validation.

A pip install operation may execute package build and installation logic with the permissions of the agent process. Because package versions and transitive dependencies are resolved at installation time, the effective code can change after the skill has been reviewed. A compromised package release, dependency, or package-index configuration could therefore introduce arbitrary code into the environment.

The installation is marked optional and is relevant only to PowerPoint conversion or image processing, which limits exposure but does not remove the supply-chain risk.

Attack Path

1. A user requests PowerPoint conversion or image processing.
2. The agent determines that the required Python packages are unavailable.
3. Following the skill instructions, the agent runs pip install python-pptx Pillow.
4. pip resolves the current package versions and their transitive dependencies from its configured index.
5. A compromised package, malicious dependency, or hostile index response supplies attacker-controlled installation code.
6. That code ...[truncated 693 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin all direct and transitive dependencies to reviewed versions.
2. Maintain a hash-locked requirements file and install with pip install --require-hashes -r requirements.txt.
3. Use an isolated virtual environment or restricted container for conversion operations.
4. Restrict package downloads to an explicitly trusted package index or internal mirror.
5. Require explicit user approval before performing any package installation.
6. Run dependency installation and document conversion under a low-privilege account with limited filesystem and network access.
7. Regularly scan pinned dependencies for known vulnerabilities and review version upgrades before deployment.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:210

Finding

Generated Presentations May Load Mutable Third-Party Font Resources

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:210
Supporting Location: references/STYLE_PRESETS.md:476-488
Vulnerability Type: External runtime dependency and viewer metadata disclosure
Risk Level: Low

Vulnerable Code

html

<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Presentation Title</title>
    <!-- Fonts via Fontshare or Google Fonts -->
    <style>

The style reference assigns fonts to external providers:

markdown

| Preset | Display Font | Body Font | Source |
|--------|--------------|-----------|--------|
| Bold Signal | Archivo Black | Space Grotesk | Google |
| Electric Studio | Manrope | Manrope | Google |
| Creative Voltage | Syne | Space Mono | Google |
| Dark Botanical | Cormorant | IBM Plex Sans | Google |
| Notebook Tabs | Bodoni Moda | DM Sans | Google |
| Pastel Geometry | Plus Jakarta Sans | Plus Jakarta Sans | Google |
| Split Pastel | Outfit | Outfit | Google |
| Vintage Editorial | Fraunces | Work Sans | Google |
| Neon Cyber | Clash Display | Satoshi | Fontshare |
| Terminal Green | JetBrains Mono | JetBrains Mono | JetBrains |

Technical Analysis

The generated HTML architecture explicitly permits fonts hosted by Google Fonts or Fontshare. Such references create runtime network dependencies despite the skill describing generated presentations as self-contained and offline-capable.

When a presentation containing a remote font reference is opened, the browser contacts the external provider. This discloses ordinary request metadata, including the viewer's IP address and browser request headers, and permits the provider-hosted resource to change independently of the reviewed presentation. The instructions do not require local font bundling, integrity validation, a restrictive Content Security Policy, or informed user consent for remote requests.

No evidence ...[truncated 1312 chars]

Remediation

View remediation

Remediation Suggestions

1. Download reviewed font files and package them locally with generated presentations.
2. Reference local fonts through @font-face declarations instead of remote provider URLs.
3. Provide suitable local fallback fonts so presentations remain usable offline.
4. If remote resources are unavoidable, clearly disclose the network request and obtain user consent.
5. Apply a restrictive Content Security Policy that permits resources only from explicitly approved origins.
6. Pin or archive approved font assets so presentation rendering remains reproducible.
7. Update the self-contained and offline-capable claims if external resources remain part of generated output.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Die Formulierung „Erstelle ein Pitch Deck für mein KI-Startup“ beschreibt eine sehr allgemeine Nutzerabsicht statt eines klar abgegrenzten Skill-Aufrufs. Ohne einschränkende Bedingungen oder Negativbeispiele könnte der Skill unbeabsichtigt bei gewöhnlichen Präsentationsanfragen aktiviert werden.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The example trigger phrase is very broad and maps to common, everyday presentation requests, which can cause the skill to activate in situations where a user did not specifically intend to use it. In an agent ecosystem, overly broad routing increases the chance of unintended tool invocation and unnecessary exposure of file-conversion or HTML-generation capabilities.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The example invocations are generic, natural-language requests such as creating a pitch deck or converting a presentation, which can easily overlap with ordinary conversation in an agent environment. If the platform uses loose matching, this may cause unintended skill activation, exposing local files like .ppt/.pptx to processing or triggering network/tool actions without clear user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

Die README beschreibt die Konvertierung von PPT-Dateien und die Erstellung neuer HTML-Präsentationen, enthält aber keinen kurzen Hinweis zu den Auswirkungen auf Nutzerdaten wie Dateiverarbeitung, Ausgabe neuer Dateien oder Umgang mit präsentationsinhalten. Für Markdown-Dateien soll auf daten- oder systemrelevante Verhaltensweisen hingewiesen werden.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

Este README describe una función que procesa archivos PPT/PPTX del usuario, pero no incluye ninguna advertencia sobre el manejo de archivos, posibles sobrescrituras, ni implicaciones de privacidad al cargar o convertir documentos. En archivos markdown, debe advertirse cuando el comportamiento puede afectar datos del usuario o su privacidad.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This is a markdown file, so missing user-facing warnings about behaviors affecting user data should be flagged. The feature list and usage examples mention PPT/PPTX conversion, which implies reading and processing user-provided files, but there is no disclosure about file handling, outputs, or possible overwriting/privacy implications.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file is a Chinese-localized README and labels language options, but within this document the skill guidance is presented only in Chinese without any user-choice mechanism in the instructions themselves. Under the policy, forcing a specific language without explicit user opt-in can be a natural-language policy concern unless the locale constraint is clearly documented as required.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The template sets '', which directs generated presentations to use English regardless of the user's locale or content language. The file does not indicate that the user is asked to choose a language or that English-only output is a justified regional constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The markdown states that inline editing includes 'auto-save to localStorage', which persists presentation content in the browser, but nearby instructions do not warn the user about this data persistence behavior. Because this can affect user data/privacy expectations, the skill description should disclose it clearly before or when offering inline editing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The phrase "no generic 'AI slop' aesthetics" imposes an English-language stylistic requirement and does not offer any user choice about language or locale. This can be read as a natural-language policy constraint because it prescribes presentation wording/style globally rather than allowing opt-in or region-specific justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.