Codex PPT

• Outcome: Pass
• Latest audit: Jul 13, 2026 · 6:33 PM UTC
• Version: 0.5.5

Overview

This skill appears to be a coherent PPT-generation tool, but it uses remote image APIs, local project files, a shared runtime, and persisted API configuration that users should understand before installing.

Install only if you are comfortable with a presentation skill that may send slide prompts and selected source images to a configured image API, creates persistent project files, stores fallback API settings in ~/.codex-ppt-skill/.env, and can install Python dependencies into a shared local virtual environment. For sensitive decks, use the built-in image tool when possible, avoid third-party OPENAI_BASE_URL providers unless trusted, set an explicit output folder, and clean up generated prompts and intermediate files afterward.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (20)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill declares no permissions while its documented behavior clearly requires environment variable access, filesystem reads/writes, shell execution, and network access for external image generation. This is dangerous because it hides the true trust boundary from reviewers and users, making it easier to run a skill with broader capabilities than expected and reducing informed consent around API calls and local file modifications.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence
• Finding: The description presents the skill as a PPT generation tool, but the documented workflow also includes external API calls, runtime/environment setup, prompt/job state management, image editing/post-processing, and assembly from pre-existing directory structures. This mismatch is risky because users may provide sensitive content expecting simple document transformation, while the skill may transmit data externally, persist artifacts locally, and perform broader automation than implied.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: This code centralizes API credential storage in a shared runtime directory for multiple local agents, widening the trust boundary around a sensitive secret. Even though the file is chmod'ed to user-read/write only where possible, sharing one credential store across agents increases the blast radius if any agent, plugin, or local process in that trust domain is compromised or over-privileged.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The example style-confirmation text is written only in Chinese and presents the interaction pattern in Chinese without offering a language fallback. In a general-purpose skill, this can cause user confusion, inaccessible workflows, and accidental mismatches between requested and generated deck language, though it is not a direct security exploit.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: Requiring the user to confirm 'Chinese text quality' hard-codes a specific language assumption into the approval workflow. This can lead to incorrect generation behavior, reduce usability for non-Chinese users, and cause the agent to impose unintended localization constraints, but it does not materially elevate security risk beyond policy/quality concerns.

Missing User Warnings

Low

• Confidence: 93% confidence
• Finding: The skill instructs creating and initializing a project directory in the current working directory or alongside the source file without requiring explicit user confirmation. This can cause unintended file creation in sensitive or unexpected locations, especially if the working directory is not dedicated to the task.

Missing User Warnings

Low

• Confidence: 95% confidence
• Finding: The document directs the agent to bootstrap a runtime environment and run assembly scripts that can install dependencies, modify the local environment, and write output files, but it does not require a user-facing warning or consent step. In an agent setting, this creates a risk of unexpected environment changes and filesystem modification beyond what the user anticipated.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The template hard-codes `"language": "Chinese"` and separately instructs Chinese text rendering, which can cause the agent to produce output in a language the user did not request. In an automation skill, this is a policy and integrity problem because it overrides user intent and can silently generate unusable or misleading deliverables.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The style brief explicitly states "all Chinese text" for slide text quality, which can override a user's requested output language or locale preferences. In a presentation-generation skill, hard-coding a language without opt-in can cause incorrect outputs, reduce usability for non-Chinese users, and create downstream policy/compliance issues where language choice must follow user or document context.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The provider sends prompt payloads and, in edit mode, local image file contents to a remote OpenAI-compatible endpoint with no consent gate, trust validation, or user-visible disclosure in this code path. In a skill that processes articles, reports, notes, and user-supplied images, this creates a real privacy and data-exfiltration risk if sensitive content is passed to an untrusted or misconfigured base_url.

Credential Access

High

• Category: Privilege Escalation

Content

def _env_path(home: Path) -> Path:
    return home / ".env"


def _requirements_path() -> Path:

• Confidence: 89% confidence
• Finding: .env"

Session Persistence

Medium

• Category: Rogue Agent

Content

## Hard Constraints

- Read the relevant `Reference Map` files before each phase. This file is the orchestration contract; detailed rules live in `docs/` and worker prompts in `prompts/`.
- Respect approval gates. Do not create final `deck_spec.json`, `speech.md`, prompt jobs, slide images, or `.pptx` before the approvals in `docs/workflow-gates-and-progress.md`.
- After the user approves the sample slide and authorizes full-deck generation, every remaining slide image job must be dispatched to a slide subagent whenever subagents are available.
- The main agent owns orchestration, prompt jobs, state recording, QA, speaker notes, and assembly. Do not silently replace available slide subagents with sequential production.
- Every final `origin_image/slide_XX.png` must be generated by the selected image backend: built-in image generation/editing tool or `scripts/image_gen.py`.

• Confidence: 73% confidence
• Finding: create final `deck_spec.json`, `speech.md`, prompt jobs, slide images, or `.pptx` before the approvals in `docs/workflow-gates-and-progress.md`. - After the user approves the sample slide and authoriz

Session Persistence

Medium

• Category: Rogue Agent

Content

Generate one image per slide with the selected image backend. Every final `slide_XX.png` must be produced by the built-in image tool or by `scripts/image_gen.py`; programmatic rendering or hybrid text overlay is not acceptable for slide image creation.

After the outline, visual style, image backend, and sample slide have all been approved, create final downstream artifacts if they do not already exist:

- `deck_spec.json`
- `prompts/slide_XX.json`

• Confidence: 68% confidence
• Finding: create final downstream artifacts if they do not already exist: - `deck_spec.json` - `prompts/slide_XX.json` - `speech.md` Do not create these final downstream artifacts before outline approval. If

Session Persistence

Medium

• Category: Rogue Agent

Content

The goal is to save a reusable visual system, not the current deck's private content.

User custom styles are saved to `${CODEX_PPT_HOME:-~/.codex-ppt-skill}/references/`, outside the skill install directory, so they survive skill updates and reinstalls. Never write user custom styles into the skill's own `references/` directory; that directory is reserved for built-in styles shipped with the skill.

## When To Use

• Confidence: 92% confidence
• Finding: write user custom styles into the skill's own `references/` directory; that directory is reserved for built-in styles shipped with the skill. ## When To Use Use this workflow when the user says thin

Unpinned Dependencies

Low

• Category: Supply Chain

Content

python-pptx>=1.0.2
Pillow>=10.0.0
openai>=2.0.0
filelock>=3.16.0

• Confidence: 96% confidence
• Finding: python-pptx>=1.0.2

Unpinned Dependencies

Low

• Category: Supply Chain

Content

python-pptx>=1.0.2
Pillow>=10.0.0
openai>=2.0.0
filelock>=3.16.0

• Confidence: 99% confidence
• Finding: Pillow>=10.0.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

python-pptx>=1.0.2
Pillow>=10.0.0
openai>=2.0.0
filelock>=3.16.0

• Confidence: 93% confidence
• Finding: openai>=2.0.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

python-pptx>=1.0.2
Pillow>=10.0.0
openai>=2.0.0
filelock>=3.16.0

• Confidence: 98% confidence
• Finding: filelock>=3.16.0

Known Vulnerable Dependency: Pillow==10.0.0 — 10 advisory(ies): CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2024-28219 (Pillow buffer overflow vulnerability); CVE-2023-4863 (libwebp: OOB write in BuildHuffmanTable) +7 more

Critical

• Category: Supply Chain
• Confidence: 99% confidence
• Finding: Pillow==10.0.0

Known Vulnerable Dependency: filelock==3.16.0 — 4 advisory(ies): CVE-2026-22701 (filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLoc); CVE-2025-68146 (filelock has a TOCTOU race condition which allows symlink attacks during lock fi); CVE-2026-22701 (filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLoc) +1 more

Medium

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: filelock==3.16.0

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.