Security audit

ppt-turn-web-generator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a tutorial-page generator with some usability and packaging issues, but no evidence of hidden access, exfiltration, destructive behavior, or unsafe persistence.

Install only if you want a skill that generates paged tutorial HTML and reusable visual style prompts. Be aware that this version appears incomplete because referenced support files are missing, and it may produce Chinese-language labels or prompts unless the agent adapts them to your request.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The skill description is very broad and includes many generic tutorial-creation scenarios, which can cause the agent to invoke this skill in contexts where it is not the best match. Over-broad triggering increases the chance of unintended routing, causing the model to follow this skill's prescriptive output rules instead of the user's actual preferences or a more appropriate skill.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: This instruction forces a Chinese-language configuration prompt regardless of the user's language or locale. That can override user intent, degrade reliability, and create unsafe cross-context behavior where the agent outputs in an unexpected language, especially in multilingual or enterprise settings.

Natural-Language Policy Violations

Medium

Confidence: 86% confidence
Finding: Mandating Chinese figure numbering conventions without user opt-in hard-codes a locale-specific output format into all generated tutorials. This can conflict with user expectations, downstream formatting requirements, or compliance standards for documentation in other languages.

Natural-Language Policy Violations

Medium

Confidence: 87% confidence
Finding: Requiring Chinese page numerals for all outputs imposes a locale-specific convention that may not match the user's requested language or audience. In an auto-invoked skill, this can silently alter deliverables and reduce trustworthiness by embedding unexpected language-specific formatting.

Static analysis

No suspicious patterns detected.