ClawHub
Back to skill

Security audit

pptx-generator

Security checks across malware telemetry and agentic risk

Overview

This skill is a local PowerPoint generator with disclosed dependencies and no evidence of hidden data access, persistence, exfiltration, or destructive behavior.

Before installing, note that this skill is mainly documented in Chinese and may activate for general requests to make a PPT. It appears suitable for generating local editable presentations, but users who need strict routing or English-only operation may want clearer invocation and language guidance.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger phrases are extremely generic (e.g. equivalent to 'make me a PPT') and overlap with normal user requests, which can cause this skill to activate when the user did not explicitly request this specific tool. Overbroad routing increases the chance of unintended delegation and can bypass more appropriate built-in capabilities or user expectations about what will happen.

Natural-Language Policy Violations

Medium
Confidence
89% confidence
Finding
The skill documentation is written almost entirely in Chinese and appears to steer usage toward Chinese-language interaction without any opt-in or language negotiation. In a multilingual agent environment, this can cause incorrect behavior, misinterpretation of instructions, or inaccessible operation for users who did not request Chinese output, which is a prompt-safety and reliability issue.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The description uses very broad activation phrasing such as 'Use when user wants to create editable PowerPoint presentations' and lists multiple styles and generic presentation-related terms without clear boundaries. This can cause the agent to invoke the skill in overly broad contexts, leading to unintended routing, reduced user control, and increased exposure if the skill later performs sensitive file generation or external actions.

Natural-Language Policy Violations

Low
Confidence
82% confidence
Finding
The description mixes Chinese and English without stating a locale-selection policy or how language preference is determined. This can cause ambiguous activation, misrouting for users in multilingual environments, and inconsistent behavior if the agent infers intent from keywords in one language that the user did not intend to invoke.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.