Security audit

Consulting Slide Generator

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Japanese consulting-slide generator, but its rendered slides load live third-party JavaScript and fonts, which is risky for confidential business content.

Review before installing if you plan to use confidential or client-sensitive slide content. Prefer bundling Tailwind CSS and fonts locally, disabling outbound network access during Chrome rendering, or avoiding sensitive data until the templates no longer depend on live CDNs. Also note that the skill is Japanese-focused and references a process template that is not included.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning

Location: assets/templates/problem.html:6
Finding: Unpinned Remote JavaScript Executes During Local Slide Rendering<![CDATA[ ## Vulnerability Details **File Locations**: - `assets/examples/01-problem-v2.html:6-7` - `assets/examples/02-solution-v2.html:6-7` - `assets/examples/03-gaptype-v2.html:6-7` - `assets/templates/compare.html:6-7` - `assets/templates/matrix.html:6-7` - `assets/templates/problem.html:6-7` - `assets/templates/solution.html:6-7` **Vulnerability Type**: Unpinned remote payload retrieval and supply-chain exposure **Risk Level**: Medium **Vulnerable Code**: ```html <script src="https://cdn.tailwindcss.com"></script> <link href="https://fonts.googleapis.com/css2?family=Noto+Sans+JP:wght@300;400;500;700;900&display=swap" rel="stylesheet"> ``` The affected HTML files are rendered through the following command in `scripts/html2png.sh:13-16`: ```bash google-chrome --headless --disable-gpu \ --screenshot="$OUTPUT" \ --window-size=1200,675 \ "file://$INPUT" 2>/dev/null ``` ### Technical Analysis Each supplied HTML template and example loads JavaScript from `https://cdn.tailwindcss.com` at rendering time. The URL is not pinned to an immutable version, and no Subresource Integrity metadata is provided. Consequently, the code that executes in headless Chrome can change after the Skill package has been reviewed. This is a remote payload execution channel rather than a purely static stylesheet dependency. When `html2png.sh` opens a generated slide, Chrome retrieves the current CDN response and executes it in the local slide page. If the CDN, its delivery path, or the referenced resource is compromised, attacker-controlled JavaScript could execute in the page context. The Google Fonts stylesheet also creates an outbound dependency and reduces rendering determinism, although the reviewed project does not contain evidence that it directly transmits sensitive slide data. No currently malicious CDN payload or deliberate exfiltration logic was found in the repository. The vulnerability is the trust placed in mutable remote code during local rendering. ### Attac ...[truncated 1534 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the runtime Tailwind CDN script from every template and example. 2. Compile Tailwind CSS ahead of time and ship the generated static CSS as a local, reviewed asset. 3. Reference bundled CSS through a local path so slide rendering does not require network access. 4. Bundle the required Noto Sans JP font files locally when confidential or reproducible rendering is required. 5. If a remote resource is unavoidable: - Pin it to an immutable version. - Use Subresource Integrity with a verified cryptographic hash. - Set an appropriate `crossorigin` attribute. - Apply a restrictive Content Security Policy. 6. Run headless Chrome in a sandboxed environment with outbound network access disabled. 7. Add an automated check that rejects remote `<script>` elements and unexpected external resource URLs in generated slides. 8. Revalidate screenshots after dependency updates and retain reviewed dependency artifacts to support reproducible builds. ]]>

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The description and introductory instructions specify the skill in Japanese and indicate it generates consulting slides in that locale, but there is no opt-in or alternative language behavior described. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is clearly justified.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The HTML declares `lang="ja"` at L02 and includes Japanese text such as `原則：` at L69, which forces a specific language/locale in the rendered output. Under the policy rule, locale-specific behavior should either be optional for the user or clearly documented as a justified regional constraint.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The HTML document explicitly sets `lang="ja"`, and the visible static labels in the template are also hard-coded in Japanese. This creates a language/locale constraint with no opt-in, fallback, or documented region-specific justification, which matches the policy category for forced language selection.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: This template pulls executable/style resources from external third-party CDNs (Tailwind CDN script and Google Fonts), which creates a supply-chain and privacy risk for a file that could otherwise render locally. Because the output is rendered via headless Chrome, any compromised or unavailable remote dependency can alter rendering, exfiltrate metadata such as IP/request timing, or break deterministic slide generation.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The HTML document explicitly sets `lang="ja"`, which indicates the template is fixed to Japanese. Under the policy rules, forcing a specific language without user opt-in or a clearly documented justification is a natural-language locale-policy concern.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The template pulls executable/styled resources from third-party CDNs at render time, which creates a supply-chain and network-dependency risk. In a headless Chrome rendering pipeline, compromised CDN content or unexpected remote responses could alter output, exfiltrate data via network requests, or break deterministic/offline rendering.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The HTML document declares `lang="ja"`, which forces a specific language/locale in the rendered output. Under the policy rules, this is a natural-language policy concern because the file does not offer user opt-in or explain that the template is intentionally region-specific.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The template fetches Tailwind CSS and a Google Font from third-party CDNs at render time. In a headless Chrome HTML-to-PNG workflow, this creates a supply-chain and privacy risk because rendering depends on remote content that could change, fail, or expose metadata about the environment making the request.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: Remote third-party resource loading is not necessary for the core function of generating a slide image and expands the attack surface unnecessarily. If the renderer has network access, an attacker or compromised dependency could influence output, cause build instability, or leak usage information through external requests.

Natural-Language Policy Violations

Low

Confidence: 92% confidence
Finding: The HTML declares `lang="ja"`, and the visible content is exclusively in Japanese, which indicates a fixed language choice. Under the policy, locale constraints should either be optional for the user or clearly justified as region-specific; this file provides neither.

Natural-Language Policy Violations

Low

Confidence: 93% confidence
Finding: The document declares `lang="ja"`, and the visible content is entirely Japanese, which indicates a fixed language choice. Under the policy rule, forcing a specific language without opt-in or documented justification is a natural-language policy concern.

Natural-Language Policy Violations

Low

Confidence: 93% confidence
Finding: The document declares `lang="ja"`, and the visible UI text is written in Japanese throughout the file. Under the policy rule, forcing a specific language without user opt-in or documented justification is a natural-language locale constraint.

Natural-Language Policy Violations

Low

Confidence: 84% confidence
Finding: This markdown guidance alternates between Japanese and English throughout the file, which imposes a multilingual locale expectation on users without any explicit opt-in or justification. Under the policy for natural-language violations, forcing a language or locale without user choice can be a concern even in reference documentation.

Static analysis

No suspicious patterns detected.