PPTAgent 协作助手

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 4:31 AM UTC
• Version: 1.0.0

Overview

This is a coherent repository-assistance skill for PPTAgent/BotSlide, with ordinary development validation commands but no hidden persistence, exfiltration, or deceptive behavior.

Before installing, confirm you want a Chinese-language PPTAgent/BotSlide helper. If you follow its validation steps, review dependency manifests and lockfiles first and run installs in a contained development environment without unrelated secrets.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/validation.md:30

Finding

Unverified Third-Party Dependency Installation Instructions

Content

View full analysis

Vulnerability Details

File Location: references/validation.md, lines 30–31 and 42–43
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code Snippets

Lines 30–31:

bash

pip install -r requirements.txt
playwright install chromium

Lines 42–43:

bash

pnpm install
pnpm build

Technical Analysis

The validation guide instructs the agent to install Python packages, Node.js packages, and a Playwright browser binary. The corresponding dependency manifests, lockfiles, version constraints, package sources, integrity hashes, and lifecycle scripts are not included in the audited Skill artifact and therefore could not be verified.

In particular, pnpm install may execute dependency lifecycle scripts, while pip install -r requirements.txt may install packages from external registries or other sources specified by the target repository. The Playwright installation command also retrieves a browser binary. The instructions do not require frozen lockfile enforcement, hash verification, trusted-registry restrictions, lifecycle-script review, or execution in an isolated environment.

This finding does not establish that any referenced dependency is currently malicious. The risk arises because the Skill recommends executing installation operations without first requiring verification of the external dependency definitions and resolved artifacts.

Attack Path

1. An agent invokes the Skill while operating in a PPTAgent or BotSlide repository.
2. The agent follows the validation instructions in references/validation.md.
3. The target repository contains a compromised dependency manifest, lockfile, package source, or lifecycle script.
4. The installation command resolves or installs the attacker-controlled component.
5. A malicious package installer or Node.js lifecycle script executes under the account running the agent.
6. The malicious code gains access to files, environment variables, network permissions ...[truncated 730 chars]

Remediation

View remediation

Remediation Suggestions

1. Require inspection of requirements.txt, package.json, and all relevant lockfiles before installation.
2. Use reproducible, locked installation modes, such as:
   • pnpm install --frozen-lockfile
   • Python packages pinned to exact versions with verified hashes
3. Restrict dependency resolution to approved registries and reject unexpected URLs, Git dependencies, local path dependencies, and untrusted package sources.
4. Review package lifecycle scripts before permitting pnpm install; use --ignore-scripts when lifecycle scripts are unnecessary.
5. Verify the provenance and integrity of downloaded Playwright browser binaries.
6. Perform installations in an isolated, unprivileged container or disposable environment without production secrets.
7. Avoid exposing SSH agents, cloud credentials, API tokens, or unrelated host directories to the installation environment.
8. Add an explicit validation gate stating that installation must stop if manifests, lockfiles, or resolved sources cannot be audited.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructions and operational guidance are written entirely in Chinese, with no indication that another language may be used or that the user can choose a preferred language. This creates a locale/language constraint that is not documented as optional or region-specific, which matches the policy category for language or locale violations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill metadata presents the skill in Chinese ('PPTAgent 协作' and the Chinese short description) while the invocation prompt is in English, suggesting a language choice is being imposed in the skill interface rather than offered to the user. The file does not document that Chinese is optional or that users may select their preferred language, which is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file presents all operational guidance in a single language, which can amount to a language/locale policy violation when no user opt-in or justification is provided. The file contains no indication that Chinese is required for a region-specific or audience-specific reason, nor does it offer alternatives.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file contains operational instructions exclusively in Chinese, which can amount to forcing a specific language on users or maintainers without opt-in. The policy allows locale constraints when they are explicitly documented and justified, but no such justification or alternative language option appears here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file contains user-facing instructions only in Chinese, which can amount to a language/locale policy violation when no opt-in or alternative language is provided. The content does not state that the skill is region-specific or otherwise justify the enforced language choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.