corporate-ppt-generator

• Analyzed: May 11, 2026, 8:01 AM
• Findings: 1
• Version: 1.0.0
• Hash: 77cf059158915c64ca96a78b82139c1aa3ab612a4eec5680bdcaab8f9b55a6de
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious due to critical security vulnerabilities in `src/index.py`. Specifically, the script is vulnerable to path traversal because it constructs the `output_path` using the unsanitized user-provided `output_filename`. Additionally, the use of `xml.etree.ElementTree` to parse the `block_xml` input without protection against external entities makes the skill susceptible to XML External Entity (XXE) attacks. While the code appears to be a legitimate tool for generating PowerPoint presentations and lacks evidence of intentional malice, these flaws provide a significant attack surface for unauthorized file access or manipulation.