Ai Ppt Generate.Skip2

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:09 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Baidu PPT-generation helper that sends user-provided presentation content to Baidu APIs, with no hidden persistence or destructive behavior found.

Install only if you are comfortable sending presentation prompts, outlines, resource links, template links, and your BAIDU_API_KEY to Baidu's Qianfan service. Avoid using private internal document URLs or regulated data unless Baidu processing is approved for that content.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description promises an end-to-end intelligent PPT generation tool that can generate PPTs, let users choose themes/templates or customize templates, ingest resource files, and return a download link for the final PPT. However, this code specifically targets the '/generate_outline' endpoint and only produces streamed outline data. It does accept an optional resource file URL, which partially aligns with the description, and exposes a basic layout option, but that is materially narrower than full theme/template selection or customization. Most importantly, it neither creates nor retrieves a final PPT file or its download address. Therefore the code behavior is materially narrower and different from the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a full intelligent PPT generation capability, including creating PPTs from prompts, selecting/customizing templates, ingesting resource files, and returning a downloadable PPT. The supplied code performs a much narrower function: it queries Baidu's get_ppt_theme endpoint and returns available PPT themes. While theme listing could be a supporting sub-feature of the larger tool, this code chunk by itself does not match the broad declared purpose and omits most of the advertised capabilities. Therefore this chunk is materially narrower than the description, so it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill declares it needs Python and documents use of an API key plus external HTTP APIs, but it does not declare any explicit tool scope such as permissions or allowed-tools. In an agent environment, missing scope declarations can cause over-broad execution and network/environment access beyond what reviewers or policy engines expect, increasing the chance of unintended data exposure or unsafe external calls.

Content

No source excerpt is available for this finding.

Ae2

Medium

• Category: analysis-evasion
• Confidence: 90% confidence

Finding

Artifact content does not match its filename extension

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/ppt_generate.py (reported line 34)May include surrounding context.

python

params["custom_tpl_url"] = custom_tpl_url
    if gen_mode:
        params["gen_mode"] = gen_mode
    with requests.post(url, headers=headers, json=params, stream=True) as response:
        response.raise_for_status()
        for line in response.iter_lines():
            line = line.decode('utf-8')

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script sends the user's query, outline, title, optional resource/template URLs, and a bearer API key to an external Baidu endpoint via HTTP. While the code implements the request as part of its functionality, there is no confirmation prompt, warning message, or explanatory comment disclosing that potentially sensitive user content and credentials are transmitted off-system.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This code performs a direct outbound HTTP request to a third-party endpoint using user-controlled parameters in the JSON body. In this skill's context, that means potentially sensitive business content, document references, or user data can leave the local trust boundary, which is especially risky because the tool is explicitly designed to process uploaded or referenced resource files.

Content

Scanner excerpt · scripts/ppt_outline_generate.py (reported line 31)May include surrounding context.

python

params["language_option"] = language_option
    if gen_mode:
        params["gen_mode"] = gen_mode
    with requests.post(url, headers=headers, json=params, stream=True) as response:
        response.raise_for_status()
        for line in response.iter_lines():
            line = line.decode('utf-8')

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script transmits user-supplied content, including the query and an optional resource URL, to Baidu's external API without any explicit consent prompt, data classification check, or warning about third-party disclosure. In an agent skill context, users may provide sensitive prompts or links to internal/private documents, making unintended exfiltration to an external service a real privacy and security risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This code accesses a sensitive credential from the BAIDU_API_KEY environment variable and uses it to authenticate a network request. While the behavior may be functionally expected, there is no explicit user-facing notice beyond an error message about missing configuration, so the sensitive operation lacks disclosure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.