PPT智能设计师

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:42 AM UTC
• Version: 1.1.0

Overview

This appears to be a real PowerPoint creation/editing skill, but it needs review because its document and web import tools use unsafe archive extraction and unrestricted network fetching.

Use this only in an isolated environment with restricted network egress, especially when converting URLs or opening PPTX/DOCX/XLSX files from others. Avoid untrusted Office archives and internal/private URLs, pin dependencies before installation, and provide image-generation API keys only for trusted provider endpoints.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/pptx_editing/ooxml/unpack.py:14

Finding

Unsafe extraction of untrusted Office archives

Content

View full analysis

Remediation

View remediation

None: root = destination.resolve() total_size = 0 max_entries = 10_000 max_total_size = 1_000_000_000 members = zf.infolist() if len(members) > max_entries: raise ValueError("Archive contains too many entries") for member in members: member_path = Path(member.filename) if member_path.is_absolute() or ".." in member_path.parts: raise ValueError(f"Unsafe archive path: {member.filename}") target = (root / member_path).resolve() if target != root and root not in target.parents: raise ValueError(f"Archive entry escapes destination: {member.filename}") total_size += member.file_size if total_size > max_total_size: raise ValueError("Archive exceeds expanded-size limit") for member in members: zf.extract(member, root) ``` Apply the same hardened helper consistently to every affected extraction site. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts_ppt/source_to_md/web_to_md.py:109

Finding

Server-side request forgery through unrestricted page and image retrieval

Content

View full analysis

str: """Fetch a web page with explicit headers and encoding detection. Args: url: Target URL. Returns: The response body as text. """ headers = { "User-Agent": CONFIG["user_agent"], "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", "Accept-Language": "zh-CN,zh;q=0.9,en;q=0.8" } try: response = _http_get(url, headers=headers, timeout=CONFIG["timeout"], verify=False) response.raise_for_status() ``` A fetched page can also cause secondary requests to arbitrary image locations: ```python abs_url = urljoin(page_url, src) if abs_url in downloaded: saved_name = downloaded[abs_url] else: try: resp = _http_get( abs_url, headers={"User-Agent": CONFIG["user_agent"]}, timeout=CONFIG["timeout"], verify=False, ) ``` ### Technical Analysis The web-to-Markdown converter accepts arbitrary URLs and issues HTTP requests without validating the resolved destination. It does not reject loopback, private, link-local, multicast, reserved, or cloud metadata addresses. Redirect destinations are not independently validated. The image downloader creates a second SSRF surface. An attacker-controlled page can include image references targeting internal services. `urljoin()` accepts absolute image URLs, so those requests are not restricted to the page's original host. The fetched page body is converted to Mar ...[truncated 1930 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts_ppt/source_to_md/web_to_md.py:54

Finding

HTTPS certificate verification disabled for downloaded presentation content

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:18

Finding

Unpinned executable dependencies create a mutable supply-chain path

Content

View full analysis

=0.6.21 svglib>=1.5.0 reportlab>=4.0.0 PyMuPDF>=1.23.0 mammoth>=1.6.0 markdownify>=0.11.6 ebooklib>=0.18 nbconvert>=7.0.0 Pillow>=9.0.0 numpy>=1.20.0 requests>=2.31.0 beautifulsoup4>=4.12.0 curl_cffi>=0.7.0 google-genai>=1.0.0 openai>=1.0.0 ``` The Skill instructions also provide an unpinned installation command: ```bash pip install python-pptx lxml Pillow numpy requests beautifulsoup4 svglib reportlab 2>/dev/null ``` ### Technical Analysis Every dependency is resolved using a minimum version constraint rather than an exact reviewed version. No lockfile or cryptographic hash validation is present in the audited project. As a result, installing the Skill at different times can produce materially different executable environments. Future package releases are accepted automatically, including releases that have not been reviewed with this Skill. Python package installation and import can execute package-controlled code, so compromise of an upstream project, release account, or distribution channel can affect the local environment. The duplicate installation command in `SKILL.md` further bypasses any future controls added only to `requirements.txt`, because it independently requests the newest compatible package versions. This finding concerns unsafe dependency resolution. The audit did not identify a specific typosquatted dependency or confirm that any currently listed package is malicious. ### Attack Path 1. A user follows the documented setup instructions. 2. `pip` resolves the newest versions satisfying the open-ended `>=` constraints. 3. An upstream package release is compromised, malicious, or unexpectedly incompatible. 4. The package is downloaded and installe ...[truncated 860 chars]

Remediation

View remediation

\ --hash=sha256: ``` Platform-specific lockfiles may be required because binary wheel hashes vary by Python version and operating system. ]]>

SkillSpector

Vulnerability Patterns

• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (951)

Tainted flow: 'url' from os.environ.get (line 79, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts_ppt/image_backends/backend_gemini.py (reported line 88)May include surrounding context.

python

},
    }

    resp = requests.post(url, json=payload, timeout=180)

    elapsed = time.time() - start
    print(f"\n  [DONE] Response received ({elapsed:.1f}s)")

Tainted flow: 'payload' from os.environ.get (line 83, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts_ppt/image_backends/backend_openai.py (reported line 91)May include surrounding context.

python

"response_format": "url",
    }

    resp = requests.post(
        f"{base_url}/images/generations",
        headers=headers,
        json=payload,

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents an end-user PPT creation/editing skill: making PPTs, drawing architecture diagrams, modifying existing decks, and using consulting templates. However, this code does not create, modify, or render PowerPoint presentations. Its primary function is to inspect existing .pptx files, extract text/formatting/position metadata, detect layout issues, and save a structured JSON inventory. That is a materially different primary purpose from PPT generation/editing. There is no evidence of image generation or unrelated sensitive access, but the core behavior is clearly analysis/export of PPT contents rather than authoring/editing them.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description suggests an end-user presentation skill focused on creating and editing PowerPoint content, including architecture diagrams and consulting/report-style decks. The supplied code does not generate slides, edit presentation content, create charts, or operate at the semantic PPT level. Instead, it is an internal packaging tool for Office Open XML documents: it copies a directory tree, rewrites XML formatting, zips it into an Office file, and optionally validates by calling soffice. This is materially different from the declared primary purpose. While support for existing PPT editing might involve file packaging internally, this chunk’s actual behavior is broader and lower-level than declared, including support for Word and Excel files, so it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description focuses on user-facing PPT creation/editing scenarios, such as making presentations, architecture diagrams, consulting decks, and modifying existing PPTs. The supplied code does not implement those behaviors. Instead, it operates at a low-level file-processing layer: extracting Office ZIP packages and reformatting internal XML for inspection/editing. While handling .pptx could be a supporting implementation detail for PPT editing, the code also explicitly supports .docx and .xlsx and contains a .docx-specific feature, which goes beyond the declared scope. Therefore the code chunk's actual purpose is materially different from the declared description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description promises PPT creation and editing across several presentation-centric scenarios. The supplied code instead implements a low-level OOXML validation utility: it parses arguments, accepts Office files or unpacked directories, unpacks zip-based Office documents, selects schema validators by file type, optionally auto-repairs specific XML issues, and runs validation. While .pptx support exists, the behavior is focused on structural/schema validation, not generating slides, drawing architecture diagrams, creating consulting-style decks, or editing existing PPT content as described. It also supports .docx and references .xlsx in inputs, which extends beyond the declared PPT-only purpose. Therefore the code's primary purpose is materially different from the declared description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description promises a presentation creation/editing skill for user-facing PPT tasks. The supplied code does not generate slides, edit presentation content, create charts/templates, or manipulate existing PPT content at the semantic level. Instead, it is infrastructure code for validating and lightly repairing OOXML package files. Its primary purpose is document-file integrity validation across Office formats (Word/PPT/Excel), including schema checks, namespace checks, relationship resolution, content type declarations, and ID uniqueness. That is a materially different capability from the declared PPT authoring/editing function, so this is a clear mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is specifically about PPT generation and editing across several presentation-related scenarios. However, the supplied code is not about creating or editing PowerPoint presentations at all. It is a validator for Word document XML (DOCX), with Word-specific namespaces and checks against document.xml, comments.xml, and numbering.xml. It also unpacks DOCX files, counts paragraphs, validates comment markers, deletion/insertion markup, and repairs durableId attributes. This is a materially different primary purpose and file domain from the declared PPT functionality, so the description does not accurately represent the code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description suggests an end-user-facing PPT creation/editing capability: making presentations, architecture diagrams, consulting decks, or modifying existing PPTs. The actual code chunk does not generate slides, edit content, create diagrams, or manipulate presentation visuals. Instead, it performs backend validation of PowerPoint OOXML/XML files for correctness and consistency. This is a materially different primary purpose from the declared skill behavior, so it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This is a clear description-behavior mismatch. The declared purpose is a PowerPoint creation/editing skill across multiple PPT scenarios. The supplied code is specifically for validating redlining/tracked changes in Word documents, as stated in its own module/class names and behavior. It operates on word/document.xml inside a DOCX package, removes/unwraps w:ins and w:del elements for a specific author, extracts paragraph text, compares original and modified Word content, and runs git diff to explain discrepancies. None of this implements PPT generation, PPT editing, architecture diagram generation, or consulting presentation templating. The primary purpose and target document format are materially different.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a broad PPT generation/editing skill, including creating new PPTs, drawing architecture diagrams, consulting-style PPTs, and modifying existing decks. The supplied code does not implement any of those core capabilities. Instead, it is a utility for rendering an existing PPTX into slide images to inspect layout and visual issues. While this could support PPT editing workflows, it is a distinct primary purpose and an undeclared capability set centered on conversion and verification, not PPT creation or editing itself.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description promises user-facing PPT creation/editing functionality, including generating decks, architecture diagrams, consulting PPTs, and modifying existing presentations. The actual code chunk does not generate or edit PPT content at all. Instead, it validates the integrity of existing project folders, checks metadata and SVG formatting, prints summaries, and writes a text report. While the code is PPT-project-related, its primary purpose is materially different from the declared purpose, so this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose describes end-user PPT creation and editing across several presentation scenarios. However, the supplied code chunk does not generate, edit, or render PPT content, diagrams, or existing presentations. Its primary function is repository/documentation maintenance: scanning an examples folder, collecting project info, organizing entries by format/date, and writing a generated README.md index file. This is a materially different purpose from PPT authoring/editing, so the description does not accurately represent the code behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This code chunk does not implement PPT creation or editing behavior. Its primary purpose is image backend support: downloading image files, validating/converting image formats, reporting resolution, handling HTTP/polling, and reading API keys. That is materially different from a slide-generation/editing skill, especially since the declared description explicitly says pure image generation is not applicable. While such utilities could be supporting code inside a larger PPT system, this specific chunk’s observable behavior is focused on image generation/download infrastructure rather than PowerPoint manipulation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose centers on PowerPoint creation and editing workflows, while this code chunk specifically performs text-to-image generation only. It sends prompts to the Gemini/Imagen API, receives base64-encoded image data, decodes it, and writes an image file to disk. There is no PPT creation, slide editing, template handling, consulting deck generation, or modification of existing presentations in this code. Because the description explicitly states that pure image generation is not applicable, this code represents a clear material mismatch rather than a supporting implementation detail.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This code chunk’s primary function is standalone image generation, which the declared description explicitly excludes ('不适用：纯图片生成'). There is no PPT creation, slide editing, template handling, architecture-diagram-to-PPT workflow, or manipulation of existing presentation files in the supplied code. While image generation could be a supporting component in a larger PPT system, this chunk itself is specifically an image backend and therefore materially mismatches the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description centers on creating and editing PowerPoint presentations, including architecture diagrams within PPT workflows. However, this code chunk does not create, edit, read, or manipulate PPT files at all. Its primary and explicit function is pure image generation, which the declared description even says is out of scope ('不适用：纯图片生成'). The code parses an image prompt, loads image-provider credentials/config from environment or .env, chooses an image backend, and calls backend.generate(...). That is a materially different primary purpose and an undeclared capability relative to the stated PPT-focused behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description emphasizes end-user PPT generation and editing scenarios (create from scratch, draw architecture diagrams, modify PPTs, consulting/report decks). However, this code chunk does not generate or edit presentation content. Instead, it prepares an existing PPTX as a reusable reference/template source by extracting metadata, exporting slides to SVG or PDF, externalizing assets, optimizing SVG structure, and writing selection metadata. These are materially different capabilities and indicate a backend template-import/preprocessing tool rather than a direct PPT authoring/editing skill. The platform automation via PowerPoint/Keynote is consistent with PPT handling, but the primary purpose is not accurately represented by the declared description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The declared description focuses on end-user PPT creation and editing scenarios, including architecture diagrams and consulting/report presentations. However, this code chunk mainly handles project scaffolding and source-ingestion workflows for a PPT pipeline. Its primary functions are init, import-sources, validate, and info, plus file movement/copying and conversion of source materials to markdown using helper scripts. Those are supportive backend utilities rather than direct PPT generation or editing capabilities. Because the actual behavior centers on project/file management and source normalization—capabilities not reflected in the declared purpose—and lacks the claimed direct PPT authoring/editing behavior in this chunk, this is a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description says this skill is for PPT generation and editing across several presentation-related scenarios. However, the provided code does not generate, edit, or manipulate PowerPoint files, slides, templates, charts, or architecture diagrams. Its primary purpose is image orientation management: reading image files, correcting EXIF orientation metadata, generating a browser-based review tool, and rotating image files based on JSON instructions. This is a materially different purpose and resource scope from PPT creation/editing, so the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description centers on PPT creation and editing across multiple presentation scenarios. However, the code chunk exclusively implements file format conversion from various document formats into Markdown, including media extraction and Pandoc-based fallback conversions. There is no functionality for creating, editing, rendering, or manipulating PowerPoint files, slides, layouts, charts, or consulting-style presentation templates. This is a clear primary-purpose mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is centered on PPT creation/editing workflows, including architecture diagrams, consulting decks, and modifying existing presentations. The supplied code does not interact with PowerPoint formats, presentation generation libraries, slide editing, or diagram creation. Its primary purpose is document conversion from PDF to Markdown using PyMuPDF, with structure inference and asset extraction. This is a materially different function and includes undeclared file-processing capabilities specific to PDFs and Markdown output, so the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description emphasizes PPT creation and editing workflows ('from zero generation', 'technical charts', 'consulting templates', 'edit existing PPT'). However, the supplied code does not generate presentations, modify slides, create diagrams, or apply templates. Its primary function is the reverse direction: parsing existing PowerPoint-compatible files and exporting their contents into Markdown plus extracted image assets. This is a materially different primary purpose and capability set from the declared skill behavior, so it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description says the skill is for PPT generation and editing across several presentation-related scenarios. However, the supplied code does not generate, edit, render, or manipulate PowerPoint/PPT files, slides, templates, or diagrams. Its primary function is unrelated: it retrieves web pages, parses main content, downloads images, converts the content to Markdown, and writes output files to disk. This is a materially different purpose and includes undeclared network crawling and file-generation behavior. Therefore, the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The code does not implement general PPT generation or editing workflows. Instead, it performs a specific asset-processing task on SVG files: reading SVG XML, locating external image references, cropping image files with Pillow, writing outputs to an images/cropped directory, and rewriting SVG references. While this could be a supporting component within a PPT pipeline, the supplied chunk’s actual behavior is much narrower and materially different from the declared end-user capability of making/editing PPTs across multiple scenarios. Therefore the description does not accurately represent this code chunk’s primary function.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts_ppt/source_to_md/web_to_md.py:131