Doc2Slides

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:02 AM UTC
• Version: 1.0.3

Overview

This skill performs the advertised document-to-slides conversion, but it sends user content to a third-party service and has under-scoped privacy, credential, and download-link handling.

Install only if you are comfortable sending presentation source material to nyoi.io. Avoid using it for confidential, regulated, or proprietary documents unless the provider's retention and access controls are acceptable. Treat API keys, job IDs, and generated download links as sensitive, and prefer a version that asks for explicit confirmation before upload and does not print full credentials in chat.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:12

Finding

API Credential Disclosed Through Conversation Output

Content

View full analysis

", "name": "" }` → returns apiKey (`rk_xxx`, shown only once) c. If 409 (name taken), pick a different name d. If 404 (no invite codes), ask user to contact the administrator 3. Tell the user the API key so they can note it if desired ``` ### Technical Analysis The skill explicitly instructs the agent to place the complete API key into conversational output. An API key is a bearer credential: any party possessing it can exercise the permissions assigned to the associated agent identity without proving a separate identity. Conversation content may be retained in chat history, platform diagnostics, observability systems, browser state, third-party integrations, exports, or shared workspaces. Displaying the credential therefore expands its exposure beyond the process that needs it. The API reference also states that the credential is shown only once by the activation endpoint, indicating that it is intended to be treated as sensitive secret material. The credential is limited to the tools permitted for the temporary agent identity, so the available evidence does not establish access to the host system or unrelated service functions. Nevertheless, exposing it permits impersonation within its authorized API scope. ### Attack Path 1. The agen ...[truncated 1097 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/api-reference.md:190

Finding

Unauthenticated Job Lookup Permits Reissuance of Download Links

Content

View full analysis

``` No authentication required. Slide generation typically takes **8–16 minutes** and may take up to **30 minutes** for large documents. Poll every 30 seconds until `status` is `completed` or `failed`. ``` The same file instructs clients to refresh expired links through the unauthenticated endpoint: ```markdown The link is valid for 2 hours. If it expires, re-request `GET /api/jobs/` for a fresh URL. ``` From `references/api-reference.md`: ```markdown ## 5. Query job status ``` GET /api/jobs/{jobId} ``` **No auth required.** Slide generation typically takes **8–16 minutes** (up to 30 min for large documents). Poll every 30 seconds until terminal status. ``` The API reference also documents continued artifact retention and link renewal: ```markdown ## 6. Download links - `artifacts[0].url` is a COS pre-signed link - Valid for 2 hours (`expiresIn: 7200`) - After expiry, re-request `GET /api/jobs/{jobId}` for a fresh link - Files are not deleted when the link expires ``` ### Technical Analysis The job-status endpoint does not require authentication. Possession of a job identifier is therefore treated as sufficient authority to access job metadata and obtain a pre-signed artifact URL. The two-hour expiration of an individual pre-signed URL does not impose an effective two-hour access lifetime because the documentation explicitly permits any caller to request a fresh URL from the unauthenticated job endpoint. Moreover, the underlying files are not deleted when a link expires. Consequently, a leaked job ID can function as a long-lived b ...[truncated 1689 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger description is broad enough to activate on many ordinary requests about creating presentations, even when the user only wants drafting help rather than file conversion. That increases the chance the agent routes sensitive user content or documents to an external service unexpectedly, which is especially risky given the skill's external upload behavior.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · references/api-reference.md (reported line 67)May include surrounding context.

": "my_agent" }

text

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `inviteCode` | string | yes | Code from the claim endpoint |
| `name` | string | yes | 3-32 chars, alphanumeric + underscore |

**Success** (201):
```json
{
  "success": true,
  "data": {
    "name": "my_agent",
    "apiKey": "rk_aBcDeFgHiJkLmNoPqRsTuVwXyZ012345",
    "allowedTools": ["doc-to-slides"],
    "rateLimit": 20,
    "expiresAfterDays": 3
  }
}

data.apiKey is the full API Key. Shown only once.

Errors:

• 400: Invalid name format or missing fields
• 409: Name already taken (pick a different name), invite code invalid or already used

---

3. Check identity

text

GET /api/agent/identity
X-Api-Key: rk_xxx

Check whether the current API Key's agent identity is still valid. Does not reset the inactivity timer.

Valid (200):

json

{
  "success": true,
  "data": {
    "name": "my_agent",
    "status"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs the agent to convert user text and documents through an external API but provides no explicit warning that the content will leave the platform. Users may unknowingly send sensitive documents, notes, or proprietary material to a third party without informed consent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill directs the agent to self-provision and rotate its own API credentials by obtaining invite codes, activating an identity, and then revealing the API key to the user. That expands the skill from simple document conversion into credential lifecycle management and secret disclosure, creating unnecessary risk of account abuse, quota theft, and uncontrolled third-party access.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

This is a real external transmission path: the skill posts user-supplied text or files to a third-party endpoint for processing. In the context of document conversion this may be functional, but it is still security-relevant because it can expose confidential or regulated content if invoked without clear consent and appropriate controls.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

Submit job

bash

curl -s -X POST https://www.nyoi.io/api/tools/doc-to-slides/execute \
  -H "Content-Type: application/json" \
  -H "X-Api-Key: <API_KEY>" \
  -d '<JSON body>'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The API reference explicitly states that GET /api/jobs/{jobId} requires no authentication and returns job metadata plus pre-signed artifact URLs when a job is completed. If job IDs are guessed, leaked, logged, or exposed through referrers or client-side code, any party can retrieve conversion status and potentially download generated slides, exposing user documents and derived content.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.