Security audit

html-ppt — HTML PPT Studio

Security checks for vulnerabilities and agentic risk

Overview

This is mainly a presentation-template skill, but it needs review because its optional renderer disables Chrome sandboxing and some templates run unverified remote JavaScript.

Review before installing. Pin the skill source to a reviewed commit, avoid rendering untrusted decks, remove --no-sandbox or run rendering inside an isolated container, and vendor or integrity-pin CDN scripts before using chart/code templates in sensitive environments.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:13
Finding: Mutable Remote Skill Installation Without Integrity Verification
Content: View full analysis
Remediation: View remediation
@ add \ https://github.com/lewislulu/html-ppt-skill/tree/ ``` The actual syntax should be verified against the installer, and the resolved artifact should additionally be checked against a published digest. ]]>

T03 · Remote Payload Retrieval and Execution

Warning

Location: templates/single-page/chart-bar.html:7
Finding: Remote JavaScript Executes Without Subresource Integrity or a Restrictive CSP
Content: View full analysis
``` The code layout loads Highlight.js resources directly from the same CDN: ```html ``` None of these external resources specifies an `integrity` attribute. The reviewed templates also do not establish a restrictive Content Security Policy around these loads. ### Technical Analysis A remote `
Remediation: View remediation
``` The placeholder must be replaced with a hash independently calculated from the exact approved artifact. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/render.sh:43
Finding: Headless Chrome Rendering Explicitly Disables the Browser Sandbox
Content: View full analysis
/dev/null 2>&1 echo " ✔ $target" } ``` ### Technical Analysis The rendering script passes `--no-sandbox` to Chrome. This disables an important defense-in-depth boundary intended to isolate renderer processes from the host operating system. The script is designed to process HTML presentations. Those presentations can contain active JavaScript and, in several supplied templates, remote CDN scripts. If a rendered document or dependency exploits a browser vulnerability, disabling the sandbox can make it easier for the exploit to affect resources accessible to the Chrome process and invoking user. The flag does not independently execute arbitrary operating-system commands. The high-risk condition arises when attacker-controlled HTML or JavaScript is rendered and successfully exploits a browser flaw. ### Attack Path 1. An attacker supplies or modifies a deck that contains malicious HTML or JavaScript, or compromises one of the remote scripts used by a template. 2. A user invokes `scripts/render.sh` on the affected file. 3. Chrome processes the active content while running with `--no-sandbox`. 4. The content triggers a compatible browser-engine vulnerability. 5. Because the normal renderer sandbox is disabled, the exploit may obtain access to the Chrome process environment and resources available to the invoking user. ### Impact Assessment If combined with a successful browser exploit, the attacker could potentially read or modify files available to the invoking user, access user-level credentials exposed to the process, init ...[truncated 374 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: assets/runtime.js:58
Finding: Presentation Titles Are Inserted Into the DOM Through an Unescaped innerHTML Sink
Content: View full analysis
{ const t = document.createElement('div'); t.className = 'thumb'; const title = s.getAttribute('data-title') || (s.querySelector('h1,h2,h3')||{}).textContent || ('Slide '+(i+1)); t.innerHTML = '
'+(i+1)+'
'+title.trim().slice(0,80)+'
'; t.addEventListener('click', () => { go(i); toggleOverview(false); }); overview.appendChild(t); }); ``` ### Technical Analysis The runtime reads the `data-title` attribute from each slide and concatenates it directly into an `innerHTML` assignment. Attribute values are treated as strings when read, but the subsequent `innerHTML` assignment reparses the value as HTML markup. An attacker who can influence a slide’s `data-title` can therefore inject elements and event-handler attributes into the generated overview thumbnail. The title is truncated to 80 characters, but that does not neutralize short executable payloads. The heading fallback uses `textContent`, but it is still inserted through `innerHTML`; therefore, markup-like heading text can also be reparsed as HTML. The primary direct source is the unrestricted `data-title` attribute. ### Attack Path 1. An attacker supplies presentation content containing a crafted slide title, for example: ```html
``` 2. The deck loads `assets/runtime.js`. 3. During initialization, the runtime reads the attacker-controlled `data-title`. 4. The title is concatenated into `t.innerHTML`. 5. The browser parses the injected element and triggers the event handler when the image load fails. 6. The payload executes with the JavaScript privileges of the presentation page. ### Impact Assessment A successful payload can read and modify pr ...[truncated 535 chars]
Remediation: View remediation
{ const thumb = document.createElement('div'); thumb.className = 'thumb'; const number = document.createElement('div'); number.className = 'n'; number.textContent = String(i + 1); const titleElement = document.createElement('div'); titleElement.className = 't'; const heading = s.querySelector('h1,h2,h3'); const title = s.getAttribute('data-title') || (heading ? heading.textContent : '') || ('Slide ' + (i + 1)); titleElement.textContent = title.trim().slice(0, 80); thumb.append(number, titleElement); thumb.addEventListener('click', () => { go(i); toggleOverview(false); }); overview.appendChild(thumb); }); ``` Additional hardening should include: 1. Use `textContent` for all presentation-derived text. 2. Avoid `innerHTML` unless content has been sanitized with a well-maintained HTML sanitizer and HTML formatting is explicitly required. 3. Add a restrictive CSP that disallows inline event handlers. 4. Add regression tests using titles containing HTML tags, quotes, event handlers, and malformed markup. 5. Treat generated or imported deck content as untrusted unless its provenance has been verified. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (120)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · README.md (reported line 8)May include surrounding context.
md
> **47 animations** (27 CSS + 20 canvas FX) — all pure static HTML/CSS/JS, no > build step. **Author:** lewis <sudolewis@gmail.com> **License:** MIT ![html-ppt — cover with live previews](docs/readme/hero.gif)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · README.md (reported line 196)May include surrounding context.
md
> **47 animations** (27 CSS + 20 canvas FX) — all pure static HTML/CSS/JS, no > build step. **Author:** lewis <sudolewis@gmail.com> **License:** MIT ![html-ppt — cover with live previews](docs/readme/hero.gif)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.
md
> **47 animations** (27 CSS + 20 canvas FX) — all pure static HTML/CSS/JS, no > build step. **Author:** lewis <sudolewis@gmail.com> **License:** MIT ![html-ppt — cover with live previews](docs/readme/hero.gif)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.
md
./scripts/render.sh templates/theme-showcase.html # one shot

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.
md
./scripts/render.sh templates/theme-showcase.html # one shot

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.
md
./scripts/render.sh templates/theme-showcase.html # one shot

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 168)May include surrounding context.
md
./scripts/render.sh templates/theme-showcase.html # one shot

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.
md
./scripts/render.sh templates/theme-showcase.html # one shot

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · examples/demo-deck/index.html (reported line 17)May include surrounding context.
html
<div class="deck">  <section class="slide" data-title="Cover"> <div class="deck-header"><span class="eyebrow">Tech sharing · 2026-04-15</span><span class="eyebrow">html-ppt</span></div> <p class="kicker">Keynote · Demo</p>

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · templates/deck.html (reported line 14)May include surrounding context.
html
<body data-themes="minimal-white,editorial-serif,soft-pastel,arctic-cool,sunset-warm,catppuccin-mocha,tokyo-night,aurora,xiaohongshu-white,neo-brutalism" data-theme-base="../assets/themes/"> <div class="deck">  <section class="slide" data-title="Cover"> <p class="kicker">html-ppt · 2026</p> <h1 class="h1 anim-fade-up" data-anim="fade-up">用模板，<span class="gradient-text">换主题</span><br>讲任何事情</h1>

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · templates/deck.html (reported line 14)May include surrounding context.
html
<body data-themes="minimal-white,editorial-serif,soft-pastel,arctic-cool,sunset-warm,catppuccin-mocha,tokyo-night,aurora,xiaohongshu-white,neo-brutalism" data-theme-base="../assets/themes/"> <div class="deck">  <section class="slide" data-title="Cover"> <p class="kicker">html-ppt · 2026</p> <h1 class="h1 anim-fade-up" data-anim="fade-up">用模板,<span class="gradient-text">换主题</span><br>讲任何事情</h1>

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · templates/full-decks/course-module/index.html (reported line 14)May include surrounding context.
html
<body class="tpl-course-module"> <div class="deck">  <section class="slide full" data-title="Cover"> <p class="kicker">CS 101 · MODULE 04</p> <h1 class="h1 mt-s">Recursion: solving<br>problems by <em>calling yourself</em>.</h1>

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · templates/full-decks/knowledge-arch-blueprint/index.html (reported line 14)May include surrounding context.
html
<body class="tpl-knowledge-arch-blueprint"> <div class="deck">  <section class="slide is-active"> <div class="kb-grid-bg"></div> <div style="display:flex;justify-content:space-between;align-items:flex-start;gap:40px;margin-bottom:44px">

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · templates/full-decks/pitch-deck/index.html (reported line 14)May include surrounding context.
html
<body class="tpl-pitch-deck"> <div class="deck">  <section class="slide" data-title="Cover"> <div class="cover-bg"></div> <div class="cover-blob"></div>

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · templates/full-decks/pitch-deck/index.html (reported line 37)May include surrounding context.
html
</div> </section>  <section class="slide" data-title="Solution"> <span class="section-num">02</span> <p class="num-tag">SOLUTION</p>

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · templates/full-decks/pitch-deck/index.html (reported line 78)May include surrounding context.
html
<p class="lede mt-l">Creators, consultants, indie devs, coaches, freelancers — the fastest-growing segment of the workforce, and the most under-served by tooling.</p> </section>  <section class="slide" data-title="Business Model"> <span class="section-num">05</span> <p class="num-tag">BUSINESS MODEL</p>

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · templates/full-decks/product-launch/index.html (reported line 14)May include surrounding context.
html
<body class="tpl-product-launch"> <div class="deck">  <section class="slide dark" data-title="Cover"> <div class="hero-shot"></div> <div style="position:absolute;top:56px;left:112px" class="brand">◎ Halo</div>

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · templates/full-decks/product-launch/index.html (reported line 44)May include surrounding context.
html
</div> </section>  <section class="slide dark" data-title="Fit"> <p class="kicker">02 · The fit</p> <h2 class="h2">4.9 grams.<br>All-day forgettable.</h2>

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · templates/full-decks/tech-sharing/index.html (reported line 14)May include surrounding context.
html
<body class="tpl-tech-sharing"> <div class="deck">  <section class="slide" data-title="Cover"> <p class="kicker">tech-sharing / 2026-04-15</p> <h1 class="h1 anim-fade-up" data-anim="fade-up">Rust 异步运行时<br>到底在<span style="background:var(--grad);-webkit-background-clip:text;background-clip:text;color:transparent">调度什么</span>?</h1>

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · templates/full-decks/testing-safety-alert/index.html (reported line 14)May include surrounding context.
html
<body class="tpl-testing-safety-alert"> <div class="deck">  <section class="slide is-active"> <div class="ts-stripe"></div> <div class="ts-chrome"><span class="ts-alert-tag">ai safety · 高优先级</span><span class="ts-page">01 / 08</span></div>

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · templates/full-decks/testing-safety-alert/index.html (reported line 79)May include surrounding context.
html
unless: <span class="st">two_human_sign_off AND within_24h</span> <span class="bad">forbidden_always</span>: - <span class="bad">"rm -rf /"</span> - <span class="bad">"drop table"</span> - <span class="bad">"force push origin main"</span></pre> <div class="ts-stripe-b"></div>

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · templates/full-decks/testing-safety-alert/index.html (reported line 79)May include surrounding context.
html
unless: <span class="st">two_human_sign_off AND within_24h</span> <span class="bad">forbidden_always</span>: - <span class="bad">"rm -rf /"</span> - <span class="bad">"drop table"</span> - <span class="bad">"force push origin main"</span></pre> <div class="ts-stripe-b"></div>

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · templates/full-decks/weekly-report/index.html (reported line 14)May include surrounding context.
html
<body class="tpl-weekly-report"> <div class="deck">  <section class="slide" data-title="Cover"> <div class="cover-head"> <div class="logo">Growth Squad</div>

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · templates/full-decks/weekly-report/index.html (reported line 76)May include surrounding context.
html
</div> </section>  <section class="slide" data-title="Blockers"> <p class="kicker">BLOCKERS · 3 items</p> <h2 class="h2">Needs attention</h2>

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The README instructs users to install the skill via npx skills add from a GitHub URL without any version or commit pinning. This creates a supply-chain risk because future changes to the referenced repository or the skills package resolution could alter what gets installed, leading to unexpected or malicious code being fetched and registered.
Content: No source excerpt is available for this finding.