help you to make annual work summary ppt

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:53 AM UTC
• Version: 1.0.0

Overview

This skill has a coherent PPT-generation purpose, but it asks the agent to run generated code and upload potentially sensitive work-summary files to an unspecified CDN without enough user control or data-handling detail.

Install only if you are comfortable with generated PPT files being uploaded to an unspecified CDN and shared by link. Avoid including secrets or highly confidential company information unless the delivery path is approved, and prefer a version that pins dependencies, confirms upload before sharing, and provides a local-only option.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:64

Finding

Unpinned Runtime Installation of a Third-Party Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 64-67
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable snippet:

bash

# Install the dependency if it is not installed
npm install pptxgenjs --prefix /tmp/pptx-pkg

Technical Analysis

The Skill instructs the agent to install pptxgenjs at runtime without specifying an exact version, lockfile, or expected integrity hash. Consequently, the package version and transitive dependency graph resolved during execution can differ from those reviewed during the Skill audit.

By default, npm packages can execute lifecycle scripts during installation. If the package, one of its transitive dependencies, or the relevant package-distribution channel is compromised, attacker-controlled installation code could execute with the permissions of the agent process. The temporary installation prefix does not prevent lifecycle scripts or subsequently imported package code from accessing other resources available to that process.

Attack Path

1. An attacker compromises the pptxgenjs package, a transitive dependency, or its distribution channel.
2. The user invokes the annual-report generation workflow on a system where the dependency is not already installed.
3. The agent runs the documented unpinned npm install command.
4. npm resolves and downloads the currently published package graph rather than a previously audited graph.
5. Malicious lifecycle code can run during installation, or malicious library code can run when the generated Node.js script imports the package.
6. The payload operates with the permissions and resource access of the agent process.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the agent's operating-system account. The affected scope may include generated presentations, user-provided business information, temporary files, environment variab ...[truncated 353 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin pptxgenjs to an exact reviewed version rather than resolving the latest version at runtime.
2. Maintain a reviewed package-lock.json and use npm ci to enforce the locked dependency graph.
3. Verify package integrity using the lockfile's integrity metadata or an independently maintained checksum.
4. Use --ignore-scripts when package lifecycle scripts are unnecessary.
5. Install dependencies during a controlled build or provisioning stage instead of during each Skill invocation.
6. Use a trusted internal registry or allowlist packages and versions where possible.
7. Run presentation generation in a sandbox with minimal filesystem, environment-variable, credential, tool, and network access.
8. Periodically scan the pinned direct and transitive dependencies for known vulnerabilities and review updates before deployment.

other

Warning

• Location: SKILL.md:137

Finding

Potentially Sensitive Report Data Is Uploaded to an Unspecified External CDN

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 137-140
Vulnerability Type: Unspecified external transfer of potentially sensitive data
Risk Level: Medium

Relevant workflow excerpt, rendered in English:

text

5. Upload to CDN — Use the upload_to_cdn tool to upload the file
6. Send to user — Send the download link through Feishu or the current channel

The resulting message also exposes the CDN URL to the selected communication channel:

text

Download link: {cdn_url}

Technical Analysis

The generated presentation can contain the user's name, role, department, work achievements, operational metrics, project information, and plans for the following year. The workflow directs the agent to upload the completed document to a CDN, but it does not identify an approved service, require explicit user confirmation, define access controls, specify link expiration, or document retention and deletion behavior.

A download link sent through Feishu or the current channel may also be forwarded, logged, indexed, or exposed to unintended channel participants. If the CDN produces public or long-lived bearer URLs, possession of the link may be sufficient to retrieve the full report.

Attack Path

1. A user supplies personal or confidential organizational information for inclusion in the annual report.
2. The agent embeds that information in the generated presentation.
3. Following the Skill instructions, the agent uploads the complete presentation through upload_to_cdn.
4. The storage destination applies unspecified access-control, retention, and link-expiration policies.
5. The agent publishes the resulting URL through Feishu or the current channel.
6. An unintended recipient, forwarded-message recipient, compromised channel participant, log reader, or party obtaining the URL retrieves the presentation.

Impact Assessment

This issue does not grant operating-system privileges or ...[truncated 459 chars]

Remediation

View remediation

Remediation Suggestions

1. Obtain explicit user confirmation before transferring the generated report to an external storage provider.
2. Identify and restrict uploads to an approved CDN or file service with documented security and privacy controls.
3. Prefer direct authenticated channel attachments or local delivery when external hosting is unnecessary.
4. Configure uploaded files as private by default and issue short-lived, single-purpose, signed download URLs.
5. Apply authentication and recipient authorization independently of URL possession.
6. Define automatic expiration and deletion periods for uploaded reports.
7. Warn users not to include secrets or highly sensitive corporate information unless the selected delivery mechanism is approved for that data.
8. Minimize collected and embedded information and redact unnecessary personal or confidential details.
9. Avoid publishing links in group channels unless the intended recipients and channel membership have been verified.
10. Record the destination, access policy, expiration time, and deletion outcome in an auditable manner without logging the report contents or reusable access tokens.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill plans to upload the generated PPT to a CDN and send it via Feishu/current channel without clearly warning the user up front that their work-summary content will be externally transmitted and stored. Since year-end summaries often contain confidential project, personnel, and performance data, lack of informed consent creates a meaningful privacy and data-exfiltration risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The description and all user-facing instructions are written to operate in Chinese, and the skill does not offer the user any language or locale choice. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern unless the locale restriction is clearly justified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger phrase matches common workplace requests such as writing year-end summaries, making it easy to invoke the skill unintentionally in contexts where the user did not consent to document generation or downstream sharing. Broad activation increases the chance that sensitive performance content is collected and processed when the user expected only conversational assistance.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs the agent to install a package and execute a generated Node.js script through the shell, which creates a broad code-execution pathway beyond simple templated PPT creation. Because the script content is synthesized from user-provided material and AI-generated logic, this expands the attack surface to command injection, unsafe file writes, dependency abuse, and unintended system access.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documented use of an exec tool to run generated scripts grants the skill arbitrary execution capability that is not narrowly limited to the stated business function. In this context, the model is asked to write code and then execute it, which is a classic high-risk pattern because prompt manipulation or malformed input can steer the generated script into unsafe behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The keyword list includes vague phrases like making a PPT, which can overlap with many benign conversations and cause accidental invocation. In a skill that later generates files and distributes them externally, overbroad triggers materially increase privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.