T08 · Insecure Dependencies
Warning
- Location
SKILL.md:477- Finding
Unpinned and Globally Installed Third-Party Dependencies
- Content
View full analysis
- Remediation
View remediation
Security audit
pptx
Security checks for vulnerabilities and agentic risk
Overview
This presentation skill mostly matches its purpose, but it needs Review because some file-processing and install behaviors are broader and less contained than users may expect.
Install only if you are comfortable with a PPTX skill that runs local conversion tools, edits Office archives, and may require global or privileged dependency installation. Prefer using it in an isolated workspace or container, keep backups of presentations before replacement or deletion workflows, avoid untrusted Office/HTML inputs, and pin or locally install dependencies instead of using global/sudo commands where possible.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/html2pptx.js:898- Finding
Untrusted HTML Is Executed in Chromium Without Network Isolation
- Content
View full analysis
{ // Log the message text to your test runner's console console.log(`Browser console: ${msg.text()}`); }); await page.goto(`file://${filePath}`); ``` ### Technical Analysis The converter opens the supplied HTML as a local `file://` document in Chromium. JavaScript remains enabled, and no Playwright routing policy is configured to reject outbound requests. As a result, active content in an attacker-controlled HTML file can execute inside the browser and initiate HTTP or HTTPS requests. The browser sandbox reduces direct operating-system access, but it does not prevent the page from sending requests to public endpoints or probing network services reachable from the host. Remote images, stylesheets, fonts, scripts, frames, and JavaScript APIs can all initiate traffic unless explicitly blocked. The implementation also does not establish an asset allowlist or confirm that referenced resources are confined to the slide workspace. ### Attack Path 1. An attacker supplies a malicious HTML slide or influences generated HTML content. 2. The presentat ...[truncated 1101 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
ooxml/scripts/unpack.py:17- Finding
Office Archives Are Extracted Without Resource Limits
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (34)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
A PPTX skill that may invoke document-level diffing or inspect non-presentation OOXML structures has capabilities beyond what the user-facing description suggests. Such hidden breadth can expose sensitive document content, metadata, or history through auxiliary tooling not expected in a presentation-only workflow.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
A PPTX skill that may invoke document-level diffing or inspect non-presentation OOXML structures has capabilities beyond what the user-facing description suggests. Such hidden breadth can expose sensitive document content, metadata, or history through auxiliary tooling not expected in a presentation-only workflow.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
A PPTX skill that may invoke document-level diffing or inspect non-presentation OOXML structures has capabilities beyond what the user-facing description suggests. Such hidden breadth can expose sensitive document content, metadata, or history through auxiliary tooling not expected in a presentation-only workflow.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
A PPTX skill that may invoke document-level diffing or inspect non-presentation OOXML structures has capabilities beyond what the user-facing description suggests. Such hidden breadth can expose sensitive document content, metadata, or history through auxiliary tooling not expected in a presentation-only workflow.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
A PPTX skill that may invoke document-level diffing or inspect non-presentation OOXML structures has capabilities beyond what the user-facing description suggests. Such hidden breadth can expose sensitive document content, metadata, or history through auxiliary tooling not expected in a presentation-only workflow.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A PPTX skill that may invoke document-level diffing or inspect non-presentation OOXML structures has capabilities beyond what the user-facing description suggests. Such hidden breadth can expose sensitive document content, metadata, or history through auxiliary tooling not expected in a presentation-only workflow.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
A PPTX skill that may invoke document-level diffing or inspect non-presentation OOXML structures has capabilities beyond what the user-facing description suggests. Such hidden breadth can expose sensitive document content, metadata, or history through auxiliary tooling not expected in a presentation-only workflow.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A PPTX skill that may invoke document-level diffing or inspect non-presentation OOXML structures has capabilities beyond what the user-facing description suggests. Such hidden breadth can expose sensitive document content, metadata, or history through auxiliary tooling not expected in a presentation-only workflow.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
A PPTX skill that may invoke document-level diffing or inspect non-presentation OOXML structures has capabilities beyond what the user-facing description suggests. Such hidden breadth can expose sensitive document content, metadata, or history through auxiliary tooling not expected in a presentation-only workflow.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 3. Create and run a JavaScript file using the [`html2pptx.js`](scripts/html2pptx.js) library to convert HTML slides to PowerPoint and save the presentation
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
Basic Slide Structure
xml <!-- ppt/slides/slide1.xml --> <p:sld> <p:cSld> <p:spTree>
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Both the module docstring and the implementation operate on WordprocessingML structures such as
word/document.xml,w:ins, andw:del, and unpack an original.docxarchive for comparison. This behavior is materially different from the manifest's stated scope of presentation creation, editing, and analysis for.pptxfiles.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill instructs use of shell commands, file reads/writes, and environment-dependent tooling, but the manifest declares no explicit tool scope or permission boundaries. This increases the chance the skill will be invoked with broader-than-necessary capabilities, making misuse or unexpected file/system access harder to constrain or audit.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrase 'or any other presentation tasks' is overly broad and can cause the skill to activate for loosely related requests. Over-broad activation increases the likelihood that shell/file-manipulating instructions run in contexts where a narrower, safer tool should have been used or where the user did not intend low-level document operations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill states that all text shapes will be cleared automatically unless replacement paragraphs are provided, but this destructive behavior is not surfaced as an up-front warning or consent gate. In practice, an agent could erase slide text unintentionally, causing silent data loss or corruption of user documents during routine editing.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md - **playwright**: `npm install -g playwright` (for HTML rendering in html2pptx) - **react-icons**: `npm install -g react-icons react react-dom` (for icons) - **sharp**: `npm install -g sharp` (for SVG rasterization and image processing) - **LibreOffice**: `sudo apt-get install libreoffice` (for PDF conversion) - **Poppler**: `sudo apt-get install poppler-utils` (for pdftoppm to convert PDF to images) - **defusedxml**: `pip install defusedxml` (for secure XML parsing)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md - **playwright**: `npm install -g playwright` (for HTML rendering in html2pptx) - **react-icons**: `npm install -g react-icons react react-dom` (for icons) - **sharp**: `npm install -g sharp` (for SVG rasterization and image processing) - **LibreOffice**: `sudo apt-get install libreoffice` (for PDF conversion) - **Poppler**: `sudo apt-get install poppler-utils` (for pdftoppm to convert PDF to images) - **defusedxml**: `pip install defusedxml` (for secure XML parsing)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This markdown file instructs the user to delete slide entries, relationship records, and slide/media files, but it does not explicitly warn that these actions can permanently remove presentation content and may be difficult to recover. Under the markdown variant of SQP-2, destructive operations affecting user data should include a clear warning about the impact on data integrity and reversibility.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The checklist directs users to remove unreferenced media, fonts, notes directories, and deleted-resource references, which can affect user data and package integrity if applied incorrectly. Although the document discusses technical correctness, it does not clearly warn that these cleanup actions may delete recoverable assets or alter presentation behavior.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest describes presentation creation, editing, and analysis, which reasonably covers reading and writing .pptx content. However, this file validates output by spawning the external
sofficeexecutable, introducing process execution as an additional capability beyond direct OOXML manipulation. Shelling out to a local program is not an obvious requirement from the stated skill purpose alone.- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python with tempfile.TemporaryDirectory() as temp_dir: try: result = subprocess.run( [ "soffice", "--headless",
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill manifest describes a presentation-focused capability for working with .pptx files, but this script's module docstring explicitly states support for Office files including .docx and .xlsx. That indicates the code is built to process Word and Excel documents in addition to presentations, which is broader than the declared skill behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script calls ZipFile.extractall on an untrusted Office archive without validating member paths. A crafted ZIP can use directory traversal entries such as ../ to overwrite files outside the intended output directory, which is especially risky in an agent/tooling context that processes user-supplied documents and writes to disk automatically.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest is specific to presentation creation, editing, and analysis, but this code includes logic that only applies to .docx files by suggesting an RSID for tracked changes. That is a document-editing feature unrelated to presentation handling and shows behavior outside the stated purpose.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python modified_file.write_text(modified_text, encoding="utf-8") # Try character-level diff first for precise differences result = subprocess.run( [ "git", "diff",
Static analysis
No suspicious patterns detected.