Security audit

PPT Presenter — 带逐字稿的演讲级PPT生成器

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent presentation generator, but its image-generation helper can write generated image files outside the requested output folder if slide names are path-like.

Review this skill before installing if you will run the bundled image-generation script. Use only trusted prompts JSON files, keep slide names to simple filenames such as letters, numbers, dashes, and underscores, and use a restricted Gemini API key. Image prompts are sent to Google's API, and generated presentations load JavaScript, CSS, and fonts from external CDNs unless you modify the template.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/generate_slide_images.py:108
Finding: Path Traversal Through Unvalidated Slide Names
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/generate_slide_images.py:31
Finding: Gemini API Credential Exposed in Request URLs
Content: View full analysis
tuple[bytes, str] | None: """Generate image using Gemini 3 Pro Image (generateContent with IMAGE modality).""" url = f"https://generativelanguage.googleapis.com/v1beta/models/{model}:generateContent?key={api_key}" payload = json.dumps({ "contents": [{"parts": [{"text": f"Generate this image: {prompt}"}]}], "generationConfig": {"responseModalities": ["IMAGE", "TEXT"]}, }).encode() req = urllib.request.Request(url, data=payload, headers={"Content-Type": "application/json"}) ``` Imagen request: ```python def generate_with_imagen(prompt: str, api_key: str, model: str = FALLBACK_MODEL) -> tuple[bytes, str] | None: """Generate image using Imagen 4.0 (predict endpoint).""" url = f"https://generativelanguage.googleapis.com/v1beta/models/{model}:predict?key={api_key}" payload = json.dumps({ "instances": [{"prompt": prompt}], "parameters": {"sampleCount": 1, "aspectRatio": "16:9"}, }).encode() req = urllib.request.Request(url, data=payload, headers={"Content-Type": "application/json"}) ``` ### Technical Analysis The Gemini API key is interpolated into the query string of every request. HTTPS protects the complete request target during transport to the declared Google endpoint, so the key is not sent in plaintext over the network. However, URL query strings are more likely than request headers to be captured by debugging tools, exception telemetry, HTTP proxy logs, monitoring systems, or other diagnostics. No code in the audited project explicitly logs the constructed URL, and the endpoint is consistent with the Skill’s documented image-generation fun ...[truncated 1766 chars]
Remediation: View remediation
str: parts = urlsplit(url) query = [ (name, "REDACTED" if name.lower() == "key" else value) for name, value in parse_qsl(parts.query, keep_blank_values=True) ] return urlunsplit(( parts.scheme, parts.netloc, parts.path, urlencode(query), parts.fragment, )) ``` ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The guidance says to match audience language and explicitly mandates Chinese for Chinese audiences. Under the policy, locale or language constraints should offer user choice or clear opt-in unless narrowly justified; this file does not state that the user can choose another language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The HTML sets lang="zh-CN" and includes user-facing keyboard hints only in Chinese, which imposes a specific language/locale on all uses of the template. There is no visible opt-in, fallback, or documented justification that this template is intended only for a Chinese-language context.
Content: No source excerpt is available for this finding.