Baoyu Slide Deck

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:50 AM UTC
• Version: 0.1.0

Overview

The skill is a coherent slide-deck generator, but its fallback runtime can download and execute an unpinned package at run time, so it should be reviewed before installation.

Install only if you are comfortable with the agent running local commands for deck generation. Prefer using a trusted, already installed Bun binary, and avoid the `npx -y bun` fallback unless the package and version are pinned or you have reviewed the runtime source. Expect the skill to create and rename files under slide-deck output folders and to read optional baoyu preference files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:32

Finding

Unpinned Bun Package Download and Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 32–35
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

text

**Agent Execution Instructions**:
1. Determine this SKILL.md file's directory path as `{baseDir}`
2. Script path = `{baseDir}/scripts/<script-name>.ts`
3. Resolve `${BUN_X}` runtime: if `bun` installed → `bun`; if `npx` available → `npx -y bun`; else suggest installing bun

Technical Analysis

The fallback command npx -y bun resolves, downloads, and executes the bun package without pinning an audited version or verifying package integrity. The -y option suppresses the normal installation confirmation, allowing externally supplied package code to execute automatically.

Because package resolution occurs at runtime, the effective executable can change after this skill has been reviewed. A compromised package release, maintainer account, registry, transitive dependency, or package-resolution configuration could therefore introduce arbitrary code. This is an insecure dependency and supply-chain execution pattern.

The reviewed project contains only SKILL.md. The referenced scripts/ and references/ files are absent, so their implementations could not be examined.

Attack Path

1. The host does not have a trusted local bun executable but does have npx.
2. The agent follows the runtime-resolution instruction in SKILL.md.
3. The agent invokes npx -y bun, causing npm infrastructure to resolve an unpinned package version.
4. A compromised or malicious package artifact is downloaded without an interactive approval step.
5. Package-controlled code executes with the permissions and environment inherited from the agent process.
6. The malicious code can access or alter resources available to that process.

Impact Assessment

Successful exploitation would provide arbitrary code execution under the operating-system iden ...[truncated 666 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the automatic npx -y bun fallback and require a trusted, locally installed Bun executable.
2. If runtime retrieval is unavoidable, pin Bun to a specifically reviewed version rather than resolving the latest available package.
3. Verify the downloaded artifact using a trusted checksum, signature, or lockfile integrity value before execution.
4. Do not suppress dependency-installation confirmation. Obtain explicit user approval before downloading or executing packages.
5. Use a trusted registry configured with appropriate integrity controls and dependency allowlisting.
6. Run merge operations in a sandbox with minimal filesystem, environment-variable, and network access.
7. Document the expected package name, exact version, source, and integrity value so future audits can reproduce the dependency set.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 506)May include surrounding context.

md

- **Backup rule**: If prompt file exists, rename to `prompts/NN-slide-{slug}-backup-YYYYMMDD-HHMMSS.md`

**After generation**:
- If `--prompts-only`, stop here and output prompt summary
- If `skip_prompt_review` is true → Skip Step 6, go to Step 7
- If `skip_prompt_review` is false → Continue to Step 6

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases include very broad terms like 'create slides', 'make a presentation', 'generate deck', and 'PPT', which may match ordinary conversation not intended to invoke this skill. Over-broad activation can cause unintended file operations, prompt generation, and execution of local scripts in contexts where the user did not explicitly request this workflow.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs the agent to run npx -y bun as a fallback without pinning a specific version. That permits retrieval and execution of whatever package version is current at runtime, creating a supply-chain risk where a compromised or changed upstream package could execute arbitrary code on the host.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 359)May include surrounding context.

options:

• label: "Yes, review prompts (Recommended)" description: "Review image generation prompts"
• label: "No, skip prompt review" description: "Proceed directly to image generation"

text

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 512)May include surrounding context.

options:

• label: "Yes, review prompts (Recommended)" description: "Review image generation prompts"
• label: "No, skip prompt review" description: "Proceed directly to image generation"

text

Static analysis

No suspicious patterns detected.