Security audit

Beamer Slide

Security checks for vulnerabilities and agentic risk

Overview

The Beamer skill is coherent and not malicious, but it needs review because it combines broad activation, shell compilation, file mutation, and a few under-scoped instructions.

Install only if you are comfortable with an agent editing Beamer projects and running LaTeX/PDF commands. Prefer explicit Beamer requests, confirm presenter/institute metadata, use safe filenames, avoid raw shell metacharacters in paths, and review any extracted files before they overwrite existing figures.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:122
Finding: Command Injection Through Unsanitized File Arguments
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:28
Finding: Unpinned Python Dependency Installation
Content: View full analysis
Remediation: View remediation
``` 2. Store the dependency in a lock file or requirements file with hashes and install it using integrity enforcement: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Record hashes for every supported distribution artifact and transitive dependency. 4. Explicitly configure the approved official package index and disable unintended extra indexes to reduce dependency-confusion exposure. 5. Install the package in an isolated virtual environment with only the permissions required for PDF rendering. 6. Periodically review and deliberately update the pinned version after checking release provenance, security advisories, and compatibility. 7. Prefer a prebuilt, trusted execution environment when available so the skill does not install dependencies dynamically during task execution. ]]>

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs the agent to default to a specific presenter format and institutional affiliation unless the user overrides it. This can cause the agent to insert false or unauthorized attribution into academic slides, creating reputational, misrepresentation, or policy/compliance issues when users do not explicitly request that affiliation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger phrases are broad enough to match many generic presentation requests, which can cause the skill to activate outside its intended Beamer-only scope. Because this skill enables powerful tools including Bash, Write, Edit, Agent, and task orchestration, accidental invocation can lead to unnecessary file modification, command execution, or workflow hijacking in unrelated contexts. The risk is elevated by the large trigger surface and the skill's strong automation behavior.
Content: No source excerpt is available for this finding.

Scope Creep

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest declares allowed tools only as Read, Write, Edit, Bash, Grep, Glob, Agent, AskUserQuestion, and task tools, but the extract-figures workflow later instructs use of mcp__pdf-mcp__pdf_get_toc, mcp__pdf-mcp__pdf_read_pages, and mcp__pdf-mcp__pdf_extract_images. That is a concrete capability beyond the declared permission/tool surface.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The invocation pattern 'review [file] or proofread [file]' is described without any limiting context, negative examples, or scope constraints. In a markdown rules file, this can be considered an ambiguous trigger because terms like 'review' and 'audit' are common requests and the document does not clarify when these action names should or should not activate the skill.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The file introduces action names like 'audit [file]' as standalone commands, but does not document boundaries for activation beyond the placeholder syntax. Because this is a markdown file and the trigger guidance is sparse, users or systems may interpret everyday uses of 'audit', 'validate', or 'review' as skill invocations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The extract-figures workflow explicitly instructs saving decoded images into the project's figures/ directory, which is a filesystem-modifying action, but it does not require user confirmation or prominently warn that local files will be created or overwritten. In an agent setting, this can lead to unexpected workspace mutation, accidental overwrite of existing assets, or unauthorized file creation when a user expected analysis-only behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.