PPT to Speech Skill

• Outcome: Review
• Latest audit: May 29, 2026 · 9:28 PM UTC
• Version: 1.0.3

Overview

This PPT conversion skill is coherent, but it can automatically download large external binaries and run privileged package installation during normal use.

Review this skill before installing. Use it only if you are comfortable with first-run downloads of LibreOffice/Poppler and possible Linux package installation with sudo; safer use is to install those dependencies yourself first, avoid running the agent as root or with passwordless sudo, and keep backups of any Markdown output that may be overwritten.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (19)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
        if update_cmd:
            subprocess.run(sudo + update_cmd, check=True, capture_output=True)
        subprocess.run(sudo + install_cmd, check=True, capture_output=True)
        print(f"已通过 {pkg_manager} 安装 poppler-utils")
        return True
    except subprocess.CalledProcessError as e:

• Confidence: 90% confidence
• Finding: subprocess.run(sudo + install_cmd, check=True, capture_output=True)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cmd = ["sudo"] + cmd

    try:
        subprocess.run(cmd, check=True)
        print("DEB 包安装完成")
    except subprocess.CalledProcessError as e:
        print(f"安装失败: {e}")

• Confidence: 93% confidence
• Finding: subprocess.run(cmd, check=True)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cmd = ["sudo"] + cmd

    try:
        subprocess.run(cmd, check=True)
        print("RPM 包安装完成")
    except subprocess.CalledProcessError as e:
        print(f"安装失败: {e}")

• Confidence: 93% confidence
• Finding: subprocess.run(cmd, check=True)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if os.geteuid() != 0:
        # 检查 sudo 是否可以无密码运行
        try:
            subprocess.run(["sudo", "-n", "true"], check=True, capture_output=True)
            sudo = ["sudo"]
        except subprocess.CalledProcessError:
            print("需要 sudo 权限安装 poppler-utils，但无法自动获取。")

• Confidence: 81% confidence
• Finding: subprocess.run(["sudo", "-n", "true"], check=True, capture_output=True)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
        if update_cmd:
            subprocess.run(sudo + update_cmd, check=True, capture_output=True)
        subprocess.run(sudo + install_cmd, check=True, capture_output=True)
        print(f"已通过 {pkg_manager} 安装 poppler-utils")
        return True

• Confidence: 89% confidence
• Finding: subprocess.run(sudo + update_cmd, check=True, capture_output=True)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

]
        print("正在提取 LibreOffice 文件（无需管理员权限）...")
        try:
            subprocess.run(cmd, check=True, capture_output=True, text=True)
        except subprocess.CalledProcessError as e:
            raise Exception(f"提取失败: {e.stderr}")

• Confidence: 86% confidence
• Finding: subprocess.run(cmd, check=True, capture_output=True, text=True)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares only Bash, Read, and Write, but the documented behavior clearly includes network access, package installation, and environment/PATH modification. This creates a capability mismatch that can cause the agent to perform more sensitive actions than users would reasonably expect, especially when processing untrusted files.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill is presented as a PPT-to-speech conversion tool, but its documented workflow also downloads large external binaries, may invoke system package managers, and lacks the claimed built-in AI generation logic beyond instructing the agent to write content. This mismatch is dangerous because users may authorize a seemingly simple document-processing task without realizing it can alter the host environment and fetch code from the network.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: A skill whose stated purpose is document conversion should not silently expand into network retrieval of executables and supporting packages without prominent disclosure and consent. Downloading external dependencies increases supply-chain and execution risk, especially because the input file itself may be attacker-controlled and trigger the workflow automatically.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill includes automatic downloads and package-manager installation attempts that go beyond normal PPT parsing and create a path for unwanted system changes. In an agent context, this is especially risky because a user request to summarize a presentation could unexpectedly trigger external network access, software installation, and privileged operations.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: This code path automatically installs poppler packages using system package managers and may use sudo. That is dangerous because a PPT-processing skill should not autonomously modify the host OS or invoke privileged package installation, especially when triggered by a routine document-conversion request.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This section downloads LibreOffice installers from the network and installs or extracts them across platforms, including package installation and msiexec usage. That creates a broad supply-chain and privilege boundary expansion inconsistent with the skill’s stated task, making compromise of mirrors or transport especially damaging.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: Creating a symlink under /usr/local/bin changes global system state and exposes a new executable path for all users/processes. For a PPT conversion skill, this is an unnecessary privileged modification that can persist beyond the session and interfere with system integrity or admin expectations.

Vague Triggers

Medium

• Confidence: 79% confidence
• Finding: The trigger phrases are broad enough that the skill may activate on ordinary requests involving slides or analysis, causing Bash execution and file writes when the user may have expected only conversational help. Because this skill can also download dependencies and modify the environment, accidental invocation materially increases risk.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation instructs the agent to overwrite the generated .md file without adequate warning, which can destroy prior extracted content or user edits. In an automated agent workflow, silent overwrite behavior is dangerous because it can cause irreversible data loss in directories containing user documents.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: At this point the script begins automatic setup behavior without a strong user warning that host packages and binaries may be installed or extracted. Hidden side effects are dangerous in an agent skill because users may think they are only transforming a file while the tool is altering the system.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: These lines initiate remote binary download behavior without meaningful consent or trust-verification messaging. In an agent context, silent network retrieval of installers is risky because users may not realize third-party code is being introduced onto the machine.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**权限要求**：
- Windows：无需管理员权限（使用便携式提取）
- Linux：若系统中未安装 poppler-utils，脚本会尝试通过 `apt`/`yum` 等包管理器安装，可能需要 sudo 权限；若无法获取 sudo，会提示手动安装。

如您不希望自动下载，可提前手动安装 LibreOffice 和 poppler-utils，并确保 `soffice` 和 `pdfinfo` 命令在 PATH 中。
---

• Confidence: 95% confidence
• Finding: sudo

Session Persistence

Medium

• Category: Rogue Agent

Content

name: ppt-to-speech
description: 将 PPT/PPTX 文件转换为结构化演讲稿。当用户说"帮我整理这份PPT"、"把这个PPT转成演讲稿/文章"、"提取PPT内容"、"生成演讲稿"、"PPT转markdown"、"分析这份幻灯片"，或提供了 .pptx 文件路径并要求处理时，立即使用此 skill。无需用户配置任何 API Key，由 Agent 自身完成演讲稿撰写。
version: 3.1.0
allowed-tools: Bash, Read, Write
---

将 PPTX 文件的每页标题、正文、演讲者备注提取为结构化数据，生成每页缩略图，最终由你（Agent）结合文字内容与缩略图，撰写一篇连贯、有感染力的 Markdown 演讲稿。

• Confidence: 70% confidence
• Finding: Write --- 将 PPTX 文件的每页标题、正文、演讲者备注提取为结构化数据，生成每页缩略图，最终由你（Agent）结合文字内容与缩略图，撰写一篇连贯、有感染力的 Markdown 演讲稿。 **输入**：用户提供的 PPTX 文件路径 —— `$ARGUMENTS` --- ## 第一步：安装 Python 依赖 首次使用前执行（已安装可跳过）： ```bash pip ins

VirusTotal

67/67 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.