PPT制作

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:34 PM UTC
• Version:
  1.0.0

Overview

This skill is a local PPT-generation toolkit whose file writes, previews, and exports match its stated purpose.

Install if you want a local PPT creation workflow and are comfortable with it creating project files and PPTX outputs in its workspace. Keep sensitive source documents out of materials/ unless needed, remove them after use, and confirm paths before creating new subskills or exporting files.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The workflow directs the agent to manually modify newly generated files after running a scaffold script, but it does not require any explicit user confirmation or warning that repository files will be created and overwritten. In an agentic environment, this can lead to unintended file writes, silent overwrites of existing content, or user surprise about persistent changes, especially if the chosen slug collides with existing paths.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill explicitly tells users to place reference materials into a local materials directory, but provides no warning that these files may contain sensitive business, educational, or personal data. In a content-generation workflow, this increases the risk of accidental retention, over-broad reuse, or unintended exposure of locally staged files through later commands, previews, or exports.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The default invocation phrase is very broad and maps closely to ordinary user requests about creating slides, which can cause the skill to be triggered in situations where the user did not explicitly intend to invoke it. Because implicit invocation is enabled, this increases the chance of overbroad routing, unintended tool use, and accidental exposure of user content to the skill workflow.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The skill enables implicit invocation with no visible trigger constraints, scope limits, or exclusion conditions. That increases the chance the agent will auto-select this PPT-generation skill in unintended contexts, causing unauthorized content generation, context leakage into slide output, or user-confusing actions without clear consent.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill enables implicit invocation without any visible activation constraints, scope checks, or user confirmation boundaries. In an agent environment, this can cause the presentation-generation skill to trigger unexpectedly from broad user input, leading to unintended file creation, content transformation, or downstream actions without clear user intent.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The skill enables implicit invocation with no trigger constraints, exclusions, or scoping rules. That increases the chance the agent will auto-select this PPT-generation subskill in contexts the user did not clearly intend, which can cause unauthorized actions, prompt-routing mistakes, or unintended disclosure of user content into deck-generation workflows.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The skill enables implicit invocation but does not define any activation boundaries, exclusion criteria, or consent requirements. In a multi-skill environment, this can cause the agent to invoke the English lesson generator unexpectedly on loosely related prompts, leading to undesired actions, prompt hijacking opportunities, or content generation outside the user's intent.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill enables implicit invocation with no trigger constraints, exclusions, or scoping, which can cause the agent to activate this PPT-generation capability in contexts the user did not clearly intend. In a content-generation skill that can create and modify slide decks, this increases the risk of unintended tool use, prompt hijacking through adjacent user content, or surprise execution that affects files or workflow state.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The skill enables implicit invocation without describing when it should trigger or constraining its scope. In an agent system, this can cause the PPT-generation skill to activate in unrelated conversations, leading to unintended tool use, prompt hijacking surface expansion, or generation/modification of presentation artifacts without clear user intent.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The skill enables implicit invocation without any visible activation scoping, guard conditions, or domain constraints. In an agent environment, this can cause the skill to trigger unexpectedly on loosely related user requests, leading to unintended access to thesis or presentation content and reduced user control over when the subskill is used.

VirusTotal

64/64 vendors flagged this skill as clean.