html-ppt — HTML PPT Studio

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:26 AM UTC
• Version: 1.0.0

Overview

This is mainly a presentation-template skill, but it needs review because its optional renderer disables Chrome sandboxing and some templates run unverified remote JavaScript.

Review before installing. Pin the skill source to a reviewed commit, avoid rendering untrusted decks, remove --no-sandbox or run rendering inside an isolated container, and vendor or integrity-pin CDN scripts before using chart/code templates in sensitive environments.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13
• Finding: Mutable Remote Skill Installation Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:13-16` **Vulnerability Type**: Unverified remote installation and supply-chain exposure **Risk Level**: Medium ### Vulnerable Code ```bash ## Install ```bash npx skills add https://github.com/lewislulu/html-ppt-skill ``` ``` ### Technical Analysis The documented installation procedure invokes `npx` and installs the Skill directly from a mutable GitHub repository URL. The command does not identify a fixed commit, immutable release artifact, checksum, or cryptographic signature. Consequently, the content installed by this command can differ from the content reviewed during this audit. A compromise of the repository, its default branch, the maintainer account, or an involved package could cause later users to install modified Skill instructions or executable scripts. The use of a remote repository is consistent with the installation purpose, and no malicious remote content was observed in the audited artifact. The weakness is the absence of controls ensuring that the installed content is identical to the reviewed version. ### Attack Path 1. An attacker compromises the upstream repository, its maintainer account, or a dependency used by the `npx` installer. 2. The attacker modifies the repository’s default branch or substitutes a malicious release. 3. A user follows the installation command in `SKILL.md`. 4. `npx` retrieves the current remote content rather than a previously audited immutable revision. 5. The modified Skill is installed and subsequently trusted or executed in the user’s environment. ### Impact Assessment A successful supply-chain compromise could modify Skill instructions, templates, JavaScript, or shell scripts. The resulting code would operate with the permissions of the user running the installation or invoking the installed Skill. The command does not itself elevate privileges, and no privilege-escalation mechanism was found. The practical scope is the files, credentia ...[truncated 102 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the installation URL to a reviewed commit hash or immutable signed release tag. 2. Publish release archives with SHA-256 checksums and require checksum verification before installation. 3. Sign releases using a verifiable mechanism such as Sigstore or signed Git tags. 4. Pin the version of the package providing the `skills` command rather than relying on an implicitly resolved `npx` package. 5. Document the expected commit and checksum in `SKILL.md`. 6. Re-audit the exact pinned artifact whenever the pinned version changes. For example, use an immutable revision rather than a default-branch URL: ```bash npx --yes <installer>@<pinned-version> add \ https://github.com/lewislulu/html-ppt-skill/tree/<reviewed-commit> ``` The actual syntax should be verified against the installer, and the resolved artifact should additionally be checked against a published digest. ]]>

T03 · Remote Payload Retrieval and Execution

Warning

• Location: templates/single-page/chart-bar.html:7
• Finding: Remote JavaScript Executes Without Subresource Integrity or a Restrictive CSP<![CDATA[ ## Vulnerability Details **File Locations**: - `examples/demo-deck/index.html:11` - `templates/single-page/chart-bar.html:7` - `templates/single-page/chart-line.html:7` - `templates/single-page/chart-pie.html:7` - `templates/single-page/chart-radar.html:7` - `templates/single-page/code.html:7-9` **Vulnerability Type**: Unverified remote payload retrieval and execution **Risk Level**: Medium ### Vulnerable Code The chart templates and demonstration deck load Chart.js directly from jsDelivr: ```html <script src="https://cdn.jsdelivr.net/npm/chart.js@4.4.3/dist/chart.umd.min.js"></script> ``` The code layout loads Highlight.js resources directly from the same CDN: ```html <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/highlight.js@11.10.0/styles/tokyo-night-dark.min.css"> <script src="https://cdn.jsdelivr.net/npm/highlight.js@11.10.0/lib/core.min.js"></script> <script src="https://cdn.jsdelivr.net/npm/highlight.js@11.10.0/lib/languages/javascript.min.js"></script> ``` None of these external resources specifies an `integrity` attribute. The reviewed templates also do not establish a restrictive Content Security Policy around these loads. ### Technical Analysis A remote `<script src>` is executable content with the same browser-page privileges as local application JavaScript. Although explicit package versions are present in the URLs, the browser does not verify that the returned bytes match a known audited artifact. If the CDN, package publication account, DNS path, or delivery infrastructure is compromised, altered JavaScript can be served and executed when a user opens or renders the affected templates. Version pinning reduces accidental changes but does not provide cryptographic response verification. This behavior also means the effective executable payload is not entirely contained in the audited project folder. ### Attack Path 1. An attacker compromises the CDN, an upstream package release, or another part of the remote deliv ...[truncated 971 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prefer vendoring reviewed copies of Chart.js and Highlight.js inside the project. 2. If CDN delivery remains necessary, calculate and add Subresource Integrity hashes to every external script and stylesheet. 3. Add `crossorigin="anonymous"` when using SRI with cross-origin resources. 4. Deploy a restrictive Content Security Policy that permits scripts only from approved local paths and explicitly approved hashed resources. 5. Avoid using broad directives such as `script-src *` or `'unsafe-eval'`. 6. Disable network access in the rendering environment after all required assets have been vendored. 7. Establish a dependency-update process that verifies package provenance and regenerates SRI hashes only after review. Example hardened reference: ```html <script src="https://cdn.jsdelivr.net/npm/chart.js@4.4.3/dist/chart.umd.min.js" integrity="sha384-REPLACE_WITH_VERIFIED_HASH" crossorigin="anonymous"> </script> ``` The placeholder must be replaced with a hash independently calculated from the exact approved artifact. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/render.sh:43
• Finding: Headless Chrome Rendering Explicitly Disables the Browser Sandbox<![CDATA[ ## Vulnerability Details **File Location**: `scripts/render.sh:43-53` **Vulnerability Type**: Unsafe browser security configuration **Risk Level**: High ### Vulnerable Code ```bash render_one() { local url="$1" target="$2" "$CHROME" \ --headless=new \ --disable-gpu \ --hide-scrollbars \ --no-sandbox \ --virtual-time-budget=4000 \ --window-size=1920,1080 \ --screenshot="$target" \ "$url" >/dev/null 2>&1 echo " ✔ $target" } ``` ### Technical Analysis The rendering script passes `--no-sandbox` to Chrome. This disables an important defense-in-depth boundary intended to isolate renderer processes from the host operating system. The script is designed to process HTML presentations. Those presentations can contain active JavaScript and, in several supplied templates, remote CDN scripts. If a rendered document or dependency exploits a browser vulnerability, disabling the sandbox can make it easier for the exploit to affect resources accessible to the Chrome process and invoking user. The flag does not independently execute arbitrary operating-system commands. The high-risk condition arises when attacker-controlled HTML or JavaScript is rendered and successfully exploits a browser flaw. ### Attack Path 1. An attacker supplies or modifies a deck that contains malicious HTML or JavaScript, or compromises one of the remote scripts used by a template. 2. A user invokes `scripts/render.sh` on the affected file. 3. Chrome processes the active content while running with `--no-sandbox`. 4. The content triggers a compatible browser-engine vulnerability. 5. Because the normal renderer sandbox is disabled, the exploit may obtain access to the Chrome process environment and resources available to the invoking user. ### Impact Assessment If combined with a successful browser exploit, the attacker could potentially read or modify files available to the invoking user, access user-level credentials exposed to the process, init ...[truncated 374 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `--no-sandbox` and allow Chrome’s normal sandbox to operate. 2. Run rendering under a dedicated, unprivileged operating-system account with no access to user credentials or unrelated files. 3. Render inside an ephemeral container or virtual machine with: - a read-only project mount where practical; - a dedicated writable output directory; - dropped Linux capabilities; - no host namespace access; - strict CPU and memory limits; - network access disabled by default. 4. Vendor all required JavaScript and font assets so network access is unnecessary during rendering. 5. Reject or sanitize untrusted active content before rendering. 6. Keep Chrome patched and use a separately maintained rendering profile. 7. If a platform limitation makes `--no-sandbox` unavoidable, fail securely unless the script detects that it is already inside an appropriately isolated container. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: assets/runtime.js:58
• Finding: Presentation Titles Are Inserted Into the DOM Through an Unescaped innerHTML Sink<![CDATA[ ## Vulnerability Details **File Location**: `assets/runtime.js:58-63` **Vulnerability Type**: DOM-based cross-site scripting **Risk Level**: Medium ### Vulnerable Code ```javascript slides.forEach((s, i) => { const t = document.createElement('div'); t.className = 'thumb'; const title = s.getAttribute('data-title') || (s.querySelector('h1,h2,h3')||{}).textContent || ('Slide '+(i+1)); t.innerHTML = '<div class="n">'+(i+1)+'</div><div class="t">'+title.trim().slice(0,80)+'</div>'; t.addEventListener('click', () => { go(i); toggleOverview(false); }); overview.appendChild(t); }); ``` ### Technical Analysis The runtime reads the `data-title` attribute from each slide and concatenates it directly into an `innerHTML` assignment. Attribute values are treated as strings when read, but the subsequent `innerHTML` assignment reparses the value as HTML markup. An attacker who can influence a slide’s `data-title` can therefore inject elements and event-handler attributes into the generated overview thumbnail. The title is truncated to 80 characters, but that does not neutralize short executable payloads. The heading fallback uses `textContent`, but it is still inserted through `innerHTML`; therefore, markup-like heading text can also be reparsed as HTML. The primary direct source is the unrestricted `data-title` attribute. ### Attack Path 1. An attacker supplies presentation content containing a crafted slide title, for example: ```html <section class="slide" data-title="<img src=x onerror=alert(document.domain)>"> ``` 2. The deck loads `assets/runtime.js`. 3. During initialization, the runtime reads the attacker-controlled `data-title`. 4. The title is concatenated into `t.innerHTML`. 5. The browser parses the injected element and triggers the event handler when the image load fails. 6. The payload executes with the JavaScript privileges of the presentation page. ### Impact Assessment A successful payload can read and modify pr ...[truncated 535 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Replace HTML-string construction with DOM node creation and `textContent` assignments: ```javascript slides.forEach((s, i) => { const thumb = document.createElement('div'); thumb.className = 'thumb'; const number = document.createElement('div'); number.className = 'n'; number.textContent = String(i + 1); const titleElement = document.createElement('div'); titleElement.className = 't'; const heading = s.querySelector('h1,h2,h3'); const title = s.getAttribute('data-title') || (heading ? heading.textContent : '') || ('Slide ' + (i + 1)); titleElement.textContent = title.trim().slice(0, 80); thumb.append(number, titleElement); thumb.addEventListener('click', () => { go(i); toggleOverview(false); }); overview.appendChild(thumb); }); ``` Additional hardening should include: 1. Use `textContent` for all presentation-derived text. 2. Avoid `innerHTML` unless content has been sanitized with a well-maintained HTML sanitizer and HTML formatting is explicitly required. 3. Add a restrictive CSP that disallows inline event handlers. 4. Add regression tests using titles containing HTML tags, quotes, event handlers, and malformed markup. 5. Treat generated or imported deck content as untrusted unless its provenance has been verified. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (120)

Chaining Abuse

High

• Category: Tool Misuse

Content

> **47 animations** (27 CSS + 20 canvas FX) — all pure static HTML/CSS/JS, no
> build step.

**Author:** lewis <[e-mail]>
**License:** MIT

![html-ppt — cover with live previews](docs/readme/hero.gif)

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Chaining Abuse

High

• Category: Tool Misuse

Content

> **47 animations** (27 CSS + 20 canvas FX) — all pure static HTML/CSS/JS, no
> build step.

**Author:** lewis <[e-mail]>
**License:** MIT

![html-ppt — cover with live previews](docs/readme/hero.gif)

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Chaining Abuse

High

• Category: Tool Misuse

Content

> **47 animations** (27 CSS + 20 canvas FX) — all pure static HTML/CSS/JS, no
> build step.

**Author:** lewis <[e-mail]>
**License:** MIT

![html-ppt — cover with live previews](docs/readme/hero.gif)

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Ae1

High

• Category: analysis-evasion

Content

./scripts/render.sh templates/theme-showcase.html # one shot

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

./scripts/render.sh templates/theme-showcase.html # one shot

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

./scripts/render.sh templates/theme-showcase.html # one shot

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

./scripts/render.sh templates/theme-showcase.html # one shot

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

./scripts/render.sh templates/theme-showcase.html # one shot

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Hidden Instructions

High

• Category: Prompt Injection

Content

<div class="deck">

  <!-- 1. Cover -->
  <section class="slide" data-title="Cover">
    <div class="deck-header"><span class="eyebrow">Tech sharing · 2026-04-15</span><span class="eyebrow">html-ppt</span></div>
    <p class="kicker">Keynote · Demo</p>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

<body data-themes="minimal-white,editorial-serif,soft-pastel,arctic-cool,sunset-warm,catppuccin-mocha,tokyo-night,aurora,xiaohongshu-white,neo-brutalism" data-theme-base="../assets/themes/">
<div class="deck">

  <!-- 1. Cover -->
  <section class="slide" data-title="Cover">
    <p class="kicker">html-ppt · 2026</p>
    <h1 class="h1 anim-fade-up" data-anim="fade-up">用模板，<span class="gradient-text">换主题</span><br>讲任何事情</h1>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

<body data-themes="minimal-white,editorial-serif,soft-pastel,arctic-cool,sunset-warm,catppuccin-mocha,tokyo-night,aurora,xiaohongshu-white,neo-brutalism" data-theme-base="../assets/themes/">
<div class="deck">

  <!-- 1. Cover -->
  <section class="slide" data-title="Cover">
    <p class="kicker">html-ppt · 2026</p>
    <h1 class="h1 anim-fade-up" data-anim="fade-up">用模板,<span class="gradient-text">换主题</span><br>讲任何事情</h1>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

<body class="tpl-course-module">
<div class="deck">

  <!-- 1. Cover -->
  <section class="slide full" data-title="Cover">
    <p class="kicker">CS 101 · MODULE 04</p>
    <h1 class="h1 mt-s">Recursion: solving<br>problems by <em>calling yourself</em>.</h1>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

<body class="tpl-knowledge-arch-blueprint">
<div class="deck">

  <!-- 1. COVER -->
  <section class="slide is-active">
    <div class="kb-grid-bg"></div>
    <div style="display:flex;justify-content:space-between;align-items:flex-start;gap:40px;margin-bottom:44px">

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

<body class="tpl-pitch-deck">
<div class="deck">

  <!-- 1. Cover -->
  <section class="slide" data-title="Cover">
    <div class="cover-bg"></div>
    <div class="cover-blob"></div>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

</div>
  </section>

  <!-- 3. Solution -->
  <section class="slide" data-title="Solution">
    <span class="section-num">02</span>
    <p class="num-tag">SOLUTION</p>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

<p class="lede mt-l">Creators, consultants, indie devs, coaches, freelancers — the fastest-growing segment of the workforce, and the most under-served by tooling.</p>
  </section>

  <!-- 6. Business model -->
  <section class="slide" data-title="Business Model">
    <span class="section-num">05</span>
    <p class="num-tag">BUSINESS MODEL</p>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

<body class="tpl-product-launch">
<div class="deck">

  <!-- 1. Cover / hero -->
  <section class="slide dark" data-title="Cover">
    <div class="hero-shot"></div>
    <div style="position:absolute;top:56px;left:112px" class="brand">◎ Halo</div>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

</div>
  </section>

  <!-- 4. Feature 2 -->
  <section class="slide dark" data-title="Fit">
    <p class="kicker">02 · The fit</p>
    <h2 class="h2">4.9 grams.<br>All-day forgettable.</h2>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

<body class="tpl-tech-sharing">
<div class="deck">

  <!-- 1. Cover -->
  <section class="slide" data-title="Cover">
    <p class="kicker">tech-sharing / 2026-04-15</p>
    <h1 class="h1 anim-fade-up" data-anim="fade-up">Rust 异步运行时<br>到底在<span style="background:var(--grad);-webkit-background-clip:text;background-clip:text;color:transparent">调度什么</span>?</h1>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

<body class="tpl-testing-safety-alert">
<div class="deck">

  <!-- 1. COVER -->
  <section class="slide is-active">
    <div class="ts-stripe"></div>
    <div class="ts-chrome"><span class="ts-alert-tag">ai safety · 高优先级</span><span class="ts-page">01 / 08</span></div>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

unless: <span class="st">two_human_sign_off AND within_24h</span>

<span class="bad">forbidden_always</span>:
  - <span class="bad">"rm -rf /"</span>
  - <span class="bad">"drop table"</span>
  - <span class="bad">"force push origin main"</span></pre>
    <div class="ts-stripe-b"></div>

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

unless: <span class="st">two_human_sign_off AND within_24h</span>

<span class="bad">forbidden_always</span>:
  - <span class="bad">"rm -rf /"</span>
  - <span class="bad">"drop table"</span>
  - <span class="bad">"force push origin main"</span></pre>
    <div class="ts-stripe-b"></div>

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Hidden Instructions

High

• Category: Prompt Injection

Content

<body class="tpl-weekly-report">
<div class="deck">

  <!-- 1. Cover -->
  <section class="slide" data-title="Cover">
    <div class="cover-head">
      <div class="logo">Growth Squad</div>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

</div>
  </section>

  <!-- 5. Blockers -->
  <section class="slide" data-title="Blockers">
    <p class="kicker">BLOCKERS · 3 items</p>
    <h2 class="h2">Needs attention</h2>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence
• Finding: The README instructs users to install the skill via `npx skills add` from a GitHub URL without any version or commit pinning. This creates a supply-chain risk because future changes to the referenced repository or the `skills` package resolution could alter what gets installed, leading to unexpected or malicious code being fetched and registered.

Static analysis

No suspicious patterns detected.