Security audit

Image to Editable PowerPoint

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently converts images into editable PowerPoint files, with disclosed local file writes and model downloads, but users should understand the dependency and model supply-chain risks.

Install only in an environment where you are comfortable with large OCR/inpainting dependencies and first-use model downloads. For more control, pin the repository and dependency versions, prefer a sandbox or virtual environment, and use --ocr-json with --skip-inpaint when you want to avoid model downloads.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:47
Finding: Unpinned Repository and Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Warning

Location: px_image2pptx/inpaint.py:40
Finding: Downloaded LAMA Model Loaded Without Project-Level Integrity Verification
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (7)

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 80% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.
md
| Input | Impact | What to tell the user | |-------|--------|----------------------| | Text on solid/flat background | Best results | No caveats needed | | Text on textured background | Good results | LAMA handles repeating textures well | | Text overlapping photos | Inpainting artifacts likely | "Areas where text covers photos may show blurring" | | Dense chart with many labels | Over-merged labels | "Crowded labels may be grouped incorrectly" |

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill describes functionality that writes an output .pptx file, but it does not declare any explicit tool scope or permissions boundary. In an agent environment, missing scope declarations can allow a skill to be invoked without clear authorization constraints, increasing the risk of unintended file creation or overwriting if the platform relies on manifest-level permissions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger phrases are broad and overlap with common user intents such as 'extract text from slide as editable' or 'reconstruct slide,' which could cause the skill to activate in situations where the user did not specifically request this workflow. Over-broad activation increases the chance of unintended file processing, model downloads, or file writes, especially in multi-skill agent environments.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest describes a local image-to-PowerPoint conversion pipeline, and this module's docstring presents it as an inpainting component. However, download_model(LAMA_MODEL_URL) fetches a model from a remote source at runtime, which is a distinct network capability not mentioned in the skill description or this file's documentation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The call to download_model(LAMA_MODEL_URL) likely fetches a model over the network, but the function provides no confirmation prompt, logging, or explicit warning that network access may occur. While the module docstring explains dependency installation, it does not disclose runtime model downloading or data-transfer behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The function signature sets lang: str = "ch", and the docstring reinforces Chinese as the default while requiring users to switch manually to English. This is a natural-language locale policy concern because the skill imposes a specific language setting by default rather than offering a neutral or user-selected choice.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The function writes image data to disk via cv2.imwrite(output_path, result_bgr). Although the function name and brief docstring imply saving a result, there is no explicit warning, confirmation, or user-facing log about overwriting or creating a file at the supplied path.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: px_image2pptx/inpaint.py:51