ClawHub
Back to skill

Security audit

html-ppt

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a real HTML report generator, but it needs review because it can auto-activate broadly, use web search, write persistent template files, and run a local screenshot command with unclear scoping.

Install only if you are comfortable with a report-generation skill that may automatically start on common report/HTML requests, search the web for supporting data, write generated HTML files, and possibly create persistent design-system files. Prefer using it in a workspace where report outputs and any validation scripts are controlled and reviewable.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (140)

Hidden Instructions

High
Category
Prompt Injection
Content
### 关键词高亮规范

```html
<!-- 数字/百分比 → <b> -->
<b style="color:var(--t);">97%</b>

<!-- 公式/代码 → <em>（等宽主色）-->
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
### 关键词高亮规范

```html
<!-- 数字/百分比 → <b> -->
<b style="color:var(--t);">97%</b>

<!-- 公式/代码 → <em>(等宽主色)-->
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
<path d="M0,0 L0,6 L6,3 z" fill="#475569"/>
    </marker>
  </defs>
  <!-- 中心系统 -->
  <rect x="245" y="74" width="210" height="70" rx="6" fill="var(--p)" opacity="0.9"/>
  <text x="350" y="103" text-anchor="middle" font-size="12" font-weight="800" fill="#fff">核心系统</text>
  <text x="350" y="120" text-anchor="middle" font-size="9" fill="rgba(255,255,255,0.75)">[Software System]</text>
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
<text x="350" y="24" text-anchor="middle" font-size="11" fill="var(--mt)">👤</text>
  <text x="350" y="44" text-anchor="middle" font-size="9" font-weight="600" fill="var(--t)">最终用户</text>
  <text x="350" y="54" text-anchor="middle" font-size="8" fill="var(--dt)">[Person]</text>
  <!-- 用户→系统箭头 -->
  <line x1="350" y1="58" x2="350" y2="74" stroke="#475569" stroke-width="1.5" marker-end="url(#c4-arr)"/>
  <text x="360" y="68" font-size="7.5" fill="#64748b">使用</text>
  <!-- 外部系统（左） -->
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
<text x="350" y="24" text-anchor="middle" font-size="11" fill="var(--mt)">👤</text>
  <text x="350" y="44" text-anchor="middle" font-size="9" font-weight="600" fill="var(--t)">最终用户</text>
  <text x="350" y="54" text-anchor="middle" font-size="8" fill="var(--dt)">[Person]</text>
  <!-- 用户→系统箭头 -->
  <line x1="350" y1="58" x2="350" y2="74" stroke="#475569" stroke-width="1.5" marker-end="url(#c4-arr)"/>
  <text x="360" y="68" font-size="7.5" fill="#64748b">使用</text>
  <!-- 外部系统(左) -->
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
<!-- 左←→中 -->
  <line x1="160" y1="109" x2="245" y2="109" stroke="#475569" stroke-width="1.5" marker-end="url(#c4-arr)"/>
  <text x="200" y="104" text-anchor="middle" font-size="7.5" fill="#64748b">调用API</text>
  <!-- 外部系统（右） -->
  <rect x="540" y="89" width="130" height="40" rx="4" fill="rgba(255,255,255,0.04)" stroke="rgba(255,255,255,0.15)" stroke-width="1" stroke-dasharray="4,3"/>
  <text x="605" y="107" text-anchor="middle" font-size="9.5" font-weight="600" fill="var(--mt)">外部服务 B</text>
  <text x="605" y="120" text-anchor="middle" font-size="7.5" fill="var(--dt)">[External System]</text>
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
<!-- 左←→中 -->
  <line x1="160" y1="109" x2="245" y2="109" stroke="#475569" stroke-width="1.5" marker-end="url(#c4-arr)"/>
  <text x="200" y="104" text-anchor="middle" font-size="7.5" fill="#64748b">调用API</text>
  <!-- 外部系统(右) -->
  <rect x="540" y="89" width="130" height="40" rx="4" fill="rgba(255,255,255,0.04)" stroke="rgba(255,255,255,0.15)" stroke-width="1" stroke-dasharray="4,3"/>
  <text x="605" y="107" text-anchor="middle" font-size="9.5" font-weight="600" fill="var(--mt)">外部服务 B</text>
  <text x="605" y="120" text-anchor="middle" font-size="7.5" fill="var(--dt)">[External System]</text>
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
<path d="M0,0 L0,6 L6,3 z" fill="#64748b"/>
    </marker>
  </defs>
  <!-- 层1：表现层 -->
  <rect x="0" y="0" width="940" height="52" rx="4" fill="rgba(59,130,246,0.1)" stroke="rgba(59,130,246,0.3)" stroke-width="1"/>
  <text x="10" y="14" font-size="9" font-weight="700" fill="#3b82f6">PRESENTATION</text>
  <rect x="120" y="8" width="140" height="34" rx="4" fill="rgba(59,130,246,0.2)" stroke="rgba(59,130,246,0.4)" stroke-width="1"/>
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
<path d="M0,0 L0,6 L6,3 z" fill="#64748b"/>
    </marker>
  </defs>
  <!-- 层1:表现层 -->
  <rect x="0" y="0" width="940" height="52" rx="4" fill="rgba(59,130,246,0.1)" stroke="rgba(59,130,246,0.3)" stroke-width="1"/>
  <text x="10" y="14" font-size="9" font-weight="700" fill="#3b82f6">PRESENTATION</text>
  <rect x="120" y="8" width="140" height="34" rx="4" fill="rgba(59,130,246,0.2)" stroke="rgba(59,130,246,0.4)" stroke-width="1"/>
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
```html
<svg viewBox="0 0 140 80" style="width:140px;height:80px;flex-shrink:0;" xmlns="http://www.w3.org/2000/svg">
  <defs>
    <!-- 轨道渐变：绿→黄→红 -->
    <linearGradient id="gaugeTrack" x1="0" y1="0" x2="1" y2="0">
      <stop offset="0%"   stop-color="#10b981"/>
      <stop offset="50%"  stop-color="#f59e0b"/>
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
```html
<svg viewBox="0 0 140 80" style="width:140px;height:80px;flex-shrink:0;" xmlns="http://www.w3.org/2000/svg">
  <defs>
    <!-- 轨道渐变:绿→黄→红 -->
    <linearGradient id="gaugeTrack" x1="0" y1="0" x2="1" y2="0">
      <stop offset="0%"   stop-color="#10b981"/>
      <stop offset="50%"  stop-color="#f59e0b"/>
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
<rect x="0" y="0" width="140" height="70"/>
    </clipPath>
  </defs>
  <!-- 灰色背景轨道（半圆） -->
  <circle cx="70" cy="70" r="52" fill="none" stroke="rgba(255,255,255,0.06)"
          stroke-width="12" clip-path="url(#topHalf)"/>
  <!-- 彩色量程轨道 -->
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
<rect x="0" y="0" width="140" height="70"/>
    </clipPath>
  </defs>
  <!-- 灰色背景轨道(半圆) -->
  <circle cx="70" cy="70" r="52" fill="none" stroke="rgba(255,255,255,0.06)"
          stroke-width="12" clip-path="url(#topHalf)"/>
  <!-- 彩色量程轨道 -->
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Vague Triggers

High
Confidence
97% confidence
Finding
The description includes very broad trigger phrases such as '生成报告', '做成HTML', and '内容可视化', plus '无需确认直接生成', making the skill likely to auto-activate for many ordinary user requests. Over-broad invocation increases the chance that the agent enters this powerful workflow unexpectedly, including its network and file-authoring behaviors, without clear user intent or consent.

Natural-Language Policy Violations

Medium
Confidence
92% confidence
Finding
This markdown file is entirely written as a Chinese-language design specification and does not indicate that other languages are supported or that the language choice is optional. Under the policy for natural-language violations, forcing a specific language without user opt-in is a reportable issue unless the locale restriction is explicitly documented and justified.

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
This file says it must only be used after workflow expansion and explicit user confirmation, which conflicts with the skill metadata stating the skill should generate immediately without confirmation. Conflicting control-flow requirements are dangerous because they can cause the agent to behave unpredictably around consent boundaries, either skipping required approval or blocking unexpectedly; for a skill that may read files and generate content automatically, ambiguity around confirmation increases the risk of unintended actions.

Intent-Code Divergence

Medium
Confidence
89% confidence
Finding
The mandatory user-confirmation language directly contradicts the skill's documented intent to run immediately without confirmation. Such contradictions weaken policy enforcement and make it easier for downstream prompts or implementations to choose whichever path is more permissive, leading to consent bypass or inconsistent execution. In an auto-triggered skill, this inconsistency is more dangerous because the user may not realize when additional gated steps should have applied.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The file instructs the agent to create new design-system files with a Write tool when a style file is missing. That expands the skill from HTML report generation into repository mutation, which can cause unauthorized file creation, persistence of attacker-influenced content, and violation of least-privilege expectations for users invoking a presentation/report skill. In this skill context, that is more dangerous because the manifest frames the capability as report generation, so users are less likely to expect side effects on the filesystem.

Natural-Language Policy Violations

Medium
Confidence
93% confidence
Finding
The document title and all operational instructions are written exclusively in Chinese, and the skill defines mandatory generation behavior for each page without offering any language or locale choice. This can violate language/locale policy when the skill is used in contexts where users have not opted into Chinese output.

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
The entire skill file is written in Chinese and provides no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the constraint is explicitly documented and justified.

Natural-Language Policy Violations

Medium
Confidence
93% confidence
Finding
This markdown file contains operational instructions exclusively in Chinese, and there is no natural-language indication that users may choose another language or that the skill is intentionally restricted to a Chinese-speaking context. Under the language/locale policy, forcing a specific language without user opt-in is a policy concern.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
This markdown file presents all operational instructions exclusively in Chinese, including mandatory workflow steps and quality gates. Under the policy rule for language or locale constraints, forcing a specific language without offering user choice or documenting a justified regional scope is a natural-language policy violation.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The workflow explicitly requires using web_search to verify topic data before generating HTML, which expands the skill from presentation/report generation into external network research. That broadens permissions and data flow, increasing the chance of unintended outbound queries, privacy leakage of user-provided topics, and dependency on live external content not strictly necessary for core report rendering.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The workflow instructs execution of a Node.js command (`node screenshot_batch.js`) as part of output validation, introducing code execution beyond what is needed for HTML generation. Any workflow that normalizes running local scripts increases attack surface because a modified script, dependency, or path could execute arbitrary code or access local files during validation.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The checklist mandates '联网核实数据已完成', which expands the skill from HTML report generation into external data retrieval and verification. That creates scope creep: the agent may access network resources, process untrusted external content, and present fetched data as validated, increasing the risk of unintended data exfiltration, prompt injection exposure, or actions beyond the declared skill purpose.

Static analysis

No suspicious patterns detected.