PPT智能设计师

• Outcome: Review
• Latest audit: Jul 28, 2026 · 6:31 AM UTC
• Version: 1.1.0

Overview

This is a real PPT generation/editing skill, but it needs Review because it combines broad web fetching, external AI API use, and watermark-removal guidance without tight boundaries.

Review this skill before installing if your decks or source documents are sensitive. Use it only with URLs and documents you trust, avoid private/internal URLs, do not set provider base URLs to untrusted hosts, keep API keys scoped, and do not use the watermark-removal workflow. Expect it to create project files, download assets, call external AI providers, and run local conversion tools.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (49)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

command = ["osascript"]
    for line in script_lines:
        command.extend(["-e", line])
    return subprocess.run(
        command,
        capture_output=True,
        text=False,

• Confidence: 94% confidence
• Finding: This invokes AppleScript via `osascript` and constructs script lines with direct interpolation of `pptx_path` and `pdf_path`. Because AppleScript string literals are delimited by double quotes, a crafted filename containing quotes or AppleScript syntax could break out of the intended literal and inject arbitrary AppleScript commands, leading to execution of attacker-controlled actions on macOS.

Tainted flow: 'url' from os.environ.get (line 79, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

},
    }

    resp = requests.post(url, json=payload, timeout=180)

    elapsed = time.time() - start
    print(f"\n  [DONE] Response received ({elapsed:.1f}s)")

• Confidence: 92% confidence
• Finding: The request URL is derived in part from the GEMINI_BASE_URL environment variable and includes the API key in the query string. If an attacker can influence the environment, requests and credentials can be redirected to an attacker-controlled endpoint, causing prompt data and the API key to be exfiltrated. In an agent/plugin setting, configurable outbound endpoints increase SSRF-style and secret-leak risk beyond ordinary SDK use.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill clearly instructs use of shell commands, filesystem read/write, environment-variable access, and networked image generation, yet declares no permissions. This creates a capability/consent mismatch: an orchestrator or reviewer may treat the skill as low-privilege while it can actually read local files, modify PPTX/XML content, call external services, and execute commands.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: URL-to-Markdown/web ingestion expands the skill from local PPT generation/editing into arbitrary remote content retrieval. That broader scope can be abused for unexpected network access, intake of untrusted content, and possible retrieval of internal or sensitive URLs if the agent is allowed to fetch user-supplied links.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly instructs reading provider API credentials from process environment variables and fallback .env files to drive image generation. While this may be operationally convenient, it expands the skill from PPT/image prompt authoring into handling secrets and external service authentication, increasing the chance that an agent accesses credentials without clear user awareness or least-privilege boundaries.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The document directs the agent to use external web services, direct APIs, and browser-based workflows to generate images, which causes project content to be transmitted outside the local PPT workflow. In a skill ostensibly focused on PPT generation/editing, this creates data exfiltration and third-party processing risk, especially if slide content is sensitive or proprietary.

Context-Inappropriate Capability

Low

• Confidence: 80% confidence
• Finding: The optional use of curl_cffi specifically to impersonate browser/TLS fingerprints for blocked sites expands the network attack surface and can undermine security controls relied upon by websites. In a tool that fetches user-supplied web content for PPT generation, this becomes more dangerous because it may facilitate access to destinations that intentionally reject automation and, depending on downstream fetch logic, can amplify SSRF-style risks.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The documentation expands the skill from PPT generation/editing into standalone image generation and image manipulation, despite the manifest explicitly excluding pure image generation. This scope drift is dangerous because it enables capabilities users and reviewers may not expect, increasing the chance of policy bypass, unreviewed external API use, and misuse outside the declared PPT context.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: Providing a dedicated watermark removal tool is a high-risk capability with little legitimate need for PPT authoring and a clear dual-use profile for removing provenance or usage restrictions from generated media. In this context, it facilitates evasion of attribution and platform safeguards, making misuse substantially more likely than benign use.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The import helper accepts arbitrary HTTP(S) URLs and fetches them through web conversion tools, giving the skill network-retrieval capability beyond narrow PPT editing. In an agent setting, this can be abused for unintended outbound access, retrieval of attacker-controlled content, or interaction with internal resources if the runtime has privileged network reach.

Context-Inappropriate Capability

Medium

• Confidence: 79% confidence
• Finding: The skill invokes Python and optionally Node-based helper programs to ingest PDFs, documents, presentations, and web pages, which broadens its effective capability surface. While useful for source import, this increases exposure to risky parser behavior, dependency issues, and indirect code/data handling beyond direct PPT generation.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: `generate_html_tool()` is presented as a generation/display helper, but it first calls `auto_fix_exif()` and rewrites image files in place. That hidden side effect violates user expectations and can cause silent data modification or corruption of project assets when the caller only intended to inspect images or produce an HTML review tool.

Intent-Code Divergence

Low

• Confidence: 80% confidence
• Finding: The top-level usage text documents only `gen` and `fix`, while the CLI also implements an `auto` command that mutates files. This interface mismatch increases the chance that operators misunderstand the tool's capabilities and safety properties, which is especially risky for a file-manipulation utility embedded in a larger agent skill.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The HTML conversion path automatically fetches remote images referenced by untrusted input documents. This creates unexpected outbound network access, leaking the host's IP/User-Agent and enabling server-side request behavior during a local document-conversion task, which is broader than the stated PPT/document-processing purpose.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: This script implements a general-purpose web crawler and HTML-to-Markdown export pipeline, including redirect following, metadata extraction, content scraping, image downloading, and local file output. That capability materially exceeds the declared PPT-generation/editing scope, increasing the attack surface and enabling collection of arbitrary remote content that may be unnecessary for the user’s requested task.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The code accepts arbitrary HTTP/HTTPS URLs and fetches them with no allowlist, purpose restriction, or user-visible safety boundary. In an agent setting, this creates unjustified network reach that can be abused for unreviewed remote content retrieval, including internal or sensitive endpoints if the runtime has such access.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The image-processing path bulk-downloads remote images referenced by fetched HTML and stores them locally, extending the tool from text conversion into secondary asset acquisition. This broadens data collection and storage behavior beyond the stated skill scope and can multiply risk through excess downloads, untrusted content storage, and unexpected persistence of remote resources.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: This script is a general-purpose web fetcher that accepts arbitrary URLs, downloads remote HTML and images, and writes the retrieved content locally. In the context of a PPT-generation/editing skill, that materially expands capability into crawler/downloader behavior, which increases attack surface for misuse such as unauthorized content collection, internal URL access if user-controlled input is passed through, or ingestion of untrusted remote content into downstream workflows.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code explicitly uses curl_cffi impersonation to mimic a modern Chrome TLS fingerprint in order to bypass anti-bot or client-blocking controls. That is a high-risk capability because it is designed to defeat server-side access restrictions and, within a PPT skill, is not necessary for the declared functionality; it also signals intentional evasion rather than ordinary compatibility handling.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The script resolves SVG <image> href values directly against the SVG directory and then opens the resulting path, without constraining it to an expected project root or image directory. A crafted SVG can therefore reference arbitrary readable local files via relative paths, causing unintended local file access and attempted processing of files outside the project scope.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: This script performs repository-wide update actions (git pull) and then conditionally executes pip install against the repository's requirements.txt, which can run arbitrary code through package installation hooks or pull in attacker-controlled dependency changes from the remote repository. That behavior is much broader than a PPT-generation skill needs and creates a software supply-chain execution path if the repository or dependencies are compromised.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: Broad trigger phrases increase the chance that the skill activates on ambiguous everyday requests and gains access to powerful file/shell/network behaviors without strong user intent. In this skill, misrouting is more dangerous because execution paths include document conversion, command execution, and modification of user-provided PPTX files.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The header-level trigger set is overly broad and lacks crisp activation boundaries, which can cause accidental invocation of a high-capability skill. Because the skill can ingest content, call external image APIs, and edit files, false activation has meaningful security and privacy consequences.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The protocol instructs the agent to download external brand assets and save them into the project workspace without requiring explicit user consent, provenance disclosure, or safety checks. This can cause silent workspace modification, introduce untrusted third-party files, and create privacy/licensing issues if assets are fetched from external sources and stored locally.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The instruction to create `brand-spec.md` modifies the project directory without telling the user that local files will be created or changed. Even though the file is plain markdown, undisclosed writes can surprise users, overwrite expected workflow artifacts, and reduce trust in the agent's behavior.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts_ppt/source_to_md/web_to_md.py:131