PPT to Speech Skill

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:40 AM UTC
• Version: 1.0.3

Overview

This PPT conversion skill performs broad automatic dependency setup, including unverified executable downloads and possible privileged system package installation, which is too risky for normal document processing.

Review carefully before installing. Use this only in a disposable or locked-down environment with LibreOffice and Poppler already installed, and avoid letting it run with sudo or administrator rights. The skill should be changed to remove automatic package-manager use, verify downloaded artifacts, avoid global symlinks, and preserve outputs without overwriting by default.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/extractor_ppt.py:160
• Finding: Unverified Remote Executable Retrieval and Execution<![CDATA[ ## Vulnerability Details **File Location**: `scripts/extractor_ppt.py`, lines 61 and 160-185; related LibreOffice download and execution at lines 239-303 and 332-340 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```python POPPLER_URLS = { "windows": "https://github.com/oschwartz10612/poppler-windows/releases/download/v25.12.0-0/Release-25.12.0-0.zip", } ``` ```python def download_poppler_windows(): """Download Windows Poppler into BIN_DIR.""" url = POPPLER_URLS["windows"] zip_path = CACHE_DIR / "poppler.zip" CACHE_DIR.mkdir(parents=True, exist_ok=True) print(f"Downloading poppler from {url}") r = requests.get(url, stream=True) r.raise_for_status() with open(zip_path, "wb") as f: for chunk in r.iter_content(chunk_size=8192): f.write(chunk) print("Extracting poppler...") with zipfile.ZipFile(zip_path, "r") as zf: zf.extractall(CACHE_DIR) extracted = list(CACHE_DIR.glob("poppler-*/bin")) if not extracted: extracted = list(CACHE_DIR.glob("poppler-*/Library/bin")) if not extracted: raise Exception("Poppler bin directory not found") poppler_bin = extracted[0] BIN_DIR.mkdir(parents=True, exist_ok=True) for exe in poppler_bin.glob("*"): shutil.copy(exe, BIN_DIR / exe.name) ``` The same pattern is used for LibreOffice: ```python r = requests.get(url, stream=True) r.raise_for_status() with open(archive_path, "wb") as f: for chunk in r.iter_content(chunk_size=8192): f.write(chunk) ``` The downloaded LibreOffice executable is subsequently invoked during conversion: ```python cmd = [ soffice_cmd, "--headless", "--convert-to", "pdf", "--outdir", str(output_dir), str(ppt_path) ] subprocess.run(cmd, check=True, capture_output=True, text=True) ``` ### Technical Analysis The Skill downloads executable Poppler and LibreOffice artifacts without veri ...[truncated 2210 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove automatic executable downloads from normal document-processing execution. 2. Prefer dependencies installed by an administrator through trusted operating-system package repositories. 3. If downloads are unavoidable: - Use official upstream distribution locations. - Pin every artifact to an immutable version and SHA-256 or stronger digest. - Verify vendor signatures using a separately distributed, pinned public key. - Reject artifacts when the digest, signature, filename, platform, or expected directory layout differs. - Restrict redirects to an explicit host allowlist. - Configure connection and read timeouts and enforce maximum download sizes. 4. Store downloaded components in an isolated, user-scoped directory that is not globally added to `PATH`. 5. Invoke validated executables by an exact absolute path. 6. Run document converters in a sandbox with no network access, minimal filesystem access, resource limits, and no elevated privileges. 7. Do not reuse an existing cached package merely because its filename exists; verify it on every use. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/extractor_ppt.py:431
• Finding: Automatic Privileged Installation of Downloaded Packages<![CDATA[ ## Vulnerability Details **File Location**: `scripts/extractor_ppt.py`, lines 67-111 and 431-506 **Vulnerability Type**: Unauthorized access and privilege escalation **Risk Level**: Critical ### Vulnerable Code The Poppler setup automatically uses available package managers and passwordless `sudo`: ```python if shutil.which("apt-get"): pkg_manager = "apt" install_cmd = ["apt-get", "install", "-y", "poppler-utils"] update_cmd = ["apt-get", "update"] elif shutil.which("yum"): pkg_manager = "yum" install_cmd = ["yum", "install", "-y", "poppler-utils"] update_cmd = None elif shutil.which("dnf"): pkg_manager = "dnf" install_cmd = ["dnf", "install", "-y", "poppler-utils"] update_cmd = None elif shutil.which("pacman"): pkg_manager = "pacman" install_cmd = ["pacman", "-S", "--noconfirm", "poppler"] update_cmd = None elif shutil.which("zypper"): pkg_manager = "zypper" install_cmd = ["zypper", "install", "-y", "poppler-utils"] update_cmd = None ``` ```python sudo = [] if os.geteuid() != 0: try: subprocess.run(["sudo", "-n", "true"], check=True, capture_output=True) sudo = ["sudo"] except subprocess.CalledProcessError: print("sudo privileges are required to install poppler-utils.") return False try: if update_cmd: subprocess.run(sudo + update_cmd, check=True, capture_output=True) subprocess.run(sudo + install_cmd, check=True, capture_output=True) ``` Downloaded LibreOffice packages are installed with root privileges: ```python cmd = ["dpkg", "-i"] + deb_files if os.geteuid() != 0: cmd = ["sudo"] + cmd try: subprocess.run(cmd, check=True) except subprocess.CalledProcessError as e: print(f"Installation failed: {e}") return False ``` ```python if shutil.which("dnf"): cmd = ["dnf", "install", "-y"] + rpm_files elif shutil.which("yum"): cmd = ["yum", "localinstall", "-y"] + rpm_files else: return False if os.geteuid ...[truncated 2343 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all automatic `sudo`, package-manager, `dpkg`, `dnf`, `yum`, and global symlink operations from the Skill. 2. If a required converter is unavailable, stop safely and provide explicit installation instructions. 3. Require dependency provisioning as a separate administrative action, outside the Agent's document-processing run. 4. Use a locked-down container or a user-scoped, prebuilt environment containing audited converter binaries. 5. Never install network-downloaded DEB or RPM files unless repository metadata, package signatures, and pinned expected versions have been independently verified. 6. Do not create entries under `/usr/local/bin`; invoke a validated executable through an explicit absolute path. 7. If a privileged action is genuinely unavoidable, require a separate interactive confirmation that lists the exact command, packages, source, and system changes. 8. Execute PPT conversion as an unprivileged account with only read access to the input file and write access to a dedicated output directory. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/extractor_ppt.py:172
• Finding: Unsafe Extraction of Externally Downloaded Archives<![CDATA[ ## Vulnerability Details **File Location**: `scripts/extractor_ppt.py`, lines 172-174 and 265-267 **Vulnerability Type**: Unsafe archive extraction **Risk Level**: High ### Vulnerable Code ```python print("Extracting poppler...") with zipfile.ZipFile(zip_path, "r") as zf: zf.extractall(CACHE_DIR) ``` ```python if ext == ".tar.gz": with tarfile.open(archive_path, "r:gz") as tar: tar.extractall(CACHE_DIR) ``` ### Technical Analysis The script extracts externally downloaded ZIP and tar archives directly into a persistent cache directory without validating archive members. There are no checks rejecting: - Absolute paths. - Parent-directory traversal components such as `../`. - Paths whose resolved destinations escape `CACHE_DIR`. - Tar symbolic links or hard links. - Device nodes or other special files. - Duplicate or unexpected filenames. - Excessive file counts or decompressed sizes. - Unexpected directory structures. This flaw compounds the unverified-download issue. Depending on Python version and archive behavior, a crafted archive may write outside the intended directory, abuse links, overwrite cached components, or consume excessive disk space. Extraction into a shared persistent cache also creates collision risks with files from earlier runs. ### Attack Path 1. An attacker gains control of a Poppler or LibreOffice archive supplied by the configured external source. 2. The attacker inserts malicious archive members containing traversal paths, links, unexpected executable files, or decompression-bomb content. 3. The Skill downloads the archive without validating its identity. 4. `extractall()` processes every member into the persistent cache directory. 5. Crafted content escapes the intended extraction boundary, redirects later writes, overwrites relevant files, or exhausts disk resources. 6. A planted executable can subsequently be copied to `BIN_DIR`, added to `PATH`, installed, or executed during document conversion. ### ...[truncated 594 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not extract an archive until its expected hash and vendor signature have been verified. 2. Extract into a new, randomly named temporary directory rather than a shared persistent cache. 3. Before extraction, validate every member: - Reject absolute paths and drive-qualified paths. - Reject `..` path components. - Resolve the destination and confirm it remains beneath the extraction root. - Reject symbolic links, hard links, devices, FIFOs, and other special entries. - Enforce an allowlist of expected directories and file types. 4. Enforce limits for archive size, member count, individual member size, and total decompressed size. 5. Refuse duplicate member names and unexpected executable files. 6. After extraction, validate the exact expected layout and move only approved files into the final directory. 7. Use safe extraction filters supported by the deployed Python version, while retaining explicit path and file-type checks for defense in depth. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:19
• Finding: Unpinned and Unverified Python Dependency Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 19 **Vulnerability Type**: Insecure dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash pip install python-pptx pdf2image Pillow requests ``` ### Technical Analysis The documented setup command installs third-party Python dependencies without pinned versions, hashes, a lock file, or an isolated environment. Consequently, installations are not reproducible and can retrieve versions that were never reviewed with the Skill. Package installation may execute build backends or setup-related code. If a package publisher account or package-distribution path is compromised, following the instruction can install attacker-controlled code. The package names shown are not apparent typos, but leaving versions and artifact identities unconstrained creates avoidable supply-chain exposure. The command also does not require binary wheels, constrain transitive dependencies, or prevent modification of a global Python environment. ### Attack Path 1. A listed package or one of its transitive dependencies publishes a compromised release, or its distribution account is compromised. 2. A user follows the Skill's first-run installation instruction. 3. `pip` resolves the newest compatible package set at that time rather than a reviewed, locked set. 4. The malicious source distribution, wheel, build backend, or imported package code is installed. 5. Malicious code executes during installation, import, or subsequent Skill execution with the user's privileges. ### Impact Assessment A compromised dependency can execute arbitrary code as the user running `pip` or the Skill. If the command is run with elevated privileges or in a shared Python environment, the impact can extend to system-wide Python packages and other applications. The likely scope includes files and credentials accessible to the user, processed presentation contents, and the integrity of future Skill executions. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Provide a reviewed dependency lock file with exact versions. 2. Pin every direct and transitive artifact using cryptographic hashes. 3. Install with a command equivalent to: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Use a dedicated virtual environment or locked-down container rather than the global Python environment. 5. Prefer prebuilt, audited wheels from an approved package index and disable unexpected source builds where practical. 6. Regularly scan locked dependencies for known vulnerabilities and review updates before changing pins. 7. Document the supported Python version and platform so dependency resolution remains reproducible. ]]>

other

Note

• Location: scripts/extractor_ppt.py:542
• Finding: Declared Markdown Output Is Never Written<![CDATA[ ## Vulnerability Details **File Location**: `scripts/extractor_ppt.py`, lines 542-568 **Vulnerability Type**: Declared behavior mismatch **Risk Level**: Low ### Vulnerable Code ```python if args.output: output_path = Path(args.output).resolve() else: output_path = input_path.parent / (input_path.stem + ".md") with tempfile.TemporaryDirectory() as tmpdir: tmp_path = Path(tmpdir) poppler_path = setup_poppler() if not setup_libreoffice(): sys.exit(1) slides_data = extract_ppt_content(input_path) try: pdf_file = ppt_to_pdf(input_path, tmp_path) thumb_dir = input_path.parent / (input_path.stem + "_thumbnails") num_pages = generate_thumbnails(pdf_file, thumb_dir, poppler_path) print(f"Generated {num_pages} thumbnails") except Exception as e: print(f"Thumbnail generation failed: {e}") thumb_dir = None print("Processing complete!") ``` ### Technical Analysis The script computes `output_path` and extracts presentation data into `slides_data`, but it never opens `output_path` or serializes the extracted data. Therefore, the Markdown file promised by `SKILL.md` is not generated. The documentation also describes outputs both as residing beside the input and as residing inside a dedicated `_output` directory. This inconsistency can cause downstream Agent steps to read, overwrite, or package files that do not exist or are stored in an unexpected location. This is a functional integrity issue rather than an independent code-execution vulnerability, but it materially contradicts the Skill's declared workflow. ### Attack Path 1. The user invokes the Skill expecting a structured Markdown extraction. 2. The script performs dependency installation, conversion, and thumbnail generation. 3. Extracted slide data remains only in memory and is discarded when the process exits. 4. No Markdown output is created despite the success message. 5. Downstream instructions attempt to re ...[truncated 539 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Serialize `slides_data` to the resolved `output_path` using an explicit UTF-8 encoding. 2. Create the output parent directory safely and write through a temporary file followed by an atomic rename. 3. Refuse to overwrite an existing file unless overwrite behavior is explicitly requested. 4. Return a nonzero exit status if required outputs cannot be created. 5. Print the exact paths of successfully generated outputs. 6. Reconcile `SKILL.md` so it specifies one consistent output directory and naming convention. 7. Add tests confirming that text, notes, thumbnails, and the final Markdown file are generated in the documented locations. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (40)

Context-Inappropriate Capability

Critical

• Confidence: 100% confidence
• Finding: This block uses package managers and sudo-elevated subprocesses to install software automatically during document processing. In context, that is far beyond the least privilege needed for a PPT utility and can lead to unauthorized privileged system changes or make a compromised dependency path much more damaging.

Context-Inappropriate Capability

Critical

• Confidence: 100% confidence
• Finding: This section installs LibreOffice packages on Linux and attempts to create a global symlink in /usr/local/bin, directly modifying host system state. Such persistent privileged changes are inappropriate for a document-processing skill and substantially increase risk if the workflow or downloaded artifacts are tampered with.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill’s stated purpose is PPT-to-speech conversion, but the instructions also authorize network downloads, dependency installation, and possible system package-manager use. That materially expands its capabilities beyond document processing and creates supply-chain and host-modification risk that a user would not reasonably expect from the description alone.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 98% confidence
• Finding: The script performs network downloads of external binaries and packages but this capability is not covered by declared permissions. Undeclared network access is especially risky here because it fetches executable content that is later used to modify the host.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 98% confidence
• Finding: The script performs network downloads of external binaries and packages but this capability is not covered by declared permissions. Undeclared network access is especially risky here because it fetches executable content that is later used to modify the host.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The module docstring claims AI-based speech generation, but the code never performs AI generation or writes the promised script. This deceptive or inaccurate description increases security risk because reviewers and users may approve capabilities based on a misleading stated purpose while missing the real host-modifying behavior.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

update_cmd = None
    elif shutil.which("pacman"):
        pkg_manager = "pacman"
        install_cmd = ["pacman", "-S", "--noconfirm", "poppler"]
        update_cmd = None
    elif shutil.which("zypper"):
        pkg_manager = "zypper"

• Confidence: 91% confidence
• Finding: The use of --noconfirm removes an interaction barrier for package installation, making it easier for the skill to alter the system without user awareness. That is especially dangerous here because package management is not central to the skill's advertised purpose.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code automatically downloads Poppler from the network for a document-conversion workflow without prior consent or strict integrity controls. Fetching executable tooling at runtime materially increases supply-chain and remote-content risk beyond what users would expect from local PPT processing.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The skill proceeds toward automatic Poppler setup and installation behavior without explicit user confirmation or a clear warning that host changes may occur. Silent dependency installation violates user expectations for a simple file-processing tool and makes accidental privileged modification more likely.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The code automatically downloads and prepares LibreOffice when it is not present, without prominent prior warning about network activity and possible installation/system changes. In this context, hidden setup of large external software is unjustified and raises both trust and supply-chain concerns.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: This section installs DEB packages via dpkg, optionally with sudo, without a clear up-front warning that the script will perform privileged host package installation. That creates a dangerous gap between the declared document-processing purpose and the actual system-level side effects.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: This code installs RPM packages through yum or dnf, potentially with sudo, without explicit warning about the privileged changes being made to the host. For a PPT-processing skill, this is excessive and could surprise users or administrators with persistent system modifications.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill advertises generation of a speech script or Markdown output, but the implementation only extracts slide content and creates thumbnails before printing completion. This mismatch is dangerous because users may authorize broader capabilities under false expectations, obscuring unjustified downloads and installations.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger phrases are broad enough that the skill may activate for generic requests about analyzing slides or generating writing, causing unintended execution of Bash and file-write behavior. In this skill, accidental invocation is more dangerous because activation can lead to downloads, installation attempts, and overwriting outputs.

Natural-Language Policy Violations

Medium

• Confidence: 79% confidence
• Finding: 文件整体以中文规定技能行为，且 L003/L008-L089 对输出形式和写作要求均默认采用中文语境，没有说明可根据用户偏好切换语言。若组织政策要求不强制特定语言或需用户选择语言，这种默认单一语言行为可能构成自然语言/地区策略问题。

Session Persistence

Medium

• Category: Rogue Agent

Content

name: ppt-to-speech
description: 将 PPT/PPTX 文件转换为结构化演讲稿。当用户说"帮我整理这份PPT"、"把这个PPT转成演讲稿/文章"、"提取PPT内容"、"生成演讲稿"、"PPT转markdown"、"分析这份幻灯片"，或提供了 .pptx 文件路径并要求处理时，立即使用此 skill。无需用户配置任何 API Key，由 Agent 自身完成演讲稿撰写。
version: 3.1.0
allowed-tools: Bash, Read, Write
---

将 PPTX 文件的每页标题、正文、演讲者备注提取为结构化数据，生成每页缩略图，最终由你（Agent）结合文字内容与缩略图，撰写一篇连贯、有感染力的 Markdown 演讲稿。

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

name: ppt-to-speech
description: 将 PPT/PPTX 文件转换为结构化演讲稿。当用户说"帮我整理这份PPT"、"把这个PPT转成演讲稿/文章"、"提取PPT内容"、"生成演讲稿"、"PPT转markdown"、"分析这份幻灯片",或提供了 .pptx 文件路径并要求处理时,立即使用此 skill。无需用户配置任何 API Key,由 Agent 自身完成演讲稿撰写。
version: 3.1.0
allowed-tools: Bash, Read, Write
---

将 PPTX 文件的每页标题、正文、演讲者备注提取为结构化数据,生成每页缩略图,最终由你(Agent)结合文字内容与缩略图,撰写一篇连贯、有感染力的 Markdown 演讲稿。

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill instructs automatic downloading of LibreOffice and Poppler and may invoke OS package managers, which introduces untrusted external code into the environment for a task that should primarily be local document parsing. Even if the sources are intended to be legitimate, silent fetching and installation increases supply-chain, integrity, and environment-tampering risk.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**权限要求**：
- Windows：无需管理员权限（使用便携式提取）
- Linux：若系统中未安装 poppler-utils，脚本会尝试通过 `apt`/`yum` 等包管理器安装，可能需要 sudo 权限；若无法获取 sudo，会提示手动安装。

如您不希望自动下载，可提前手动安装 LibreOffice 和 poppler-utils，并确保 `soffice` 和 `pdfinfo` 命令在 PATH 中。
---

• Confidence: 97% confidence
• Finding: The skill contemplates using `sudo` and system package managers to install dependencies, which elevates a document-conversion workflow into privileged system administration. If triggered inappropriately or if package sources are compromised, this could modify the host broadly and violate least-privilege expectations.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill directs the agent to overwrite the generated `.md` file without a warning or a safer save-as flow. Destructive writes can erase intermediate extracted content and surprise users, especially if they expected the original extraction artifacts to be preserved for verification or reuse.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The sample speech explicitly describes an AI agent logging into a supermarket account, retrieving secrets from 1Password, obtaining SMS codes, and placing orders automatically. Even though this is presented as marketing/example content rather than executable logic, it normalizes high-risk account actions without any warning about consent, credential handling, privacy, or step-up confirmation, which could encourage unsafe agent behavior or user expectations in a skill designed to process user files into structured output.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: The natural-language description and user-facing messaging indicate a fixed Chinese-language experience, but there is no opt-in, language selection, or justification for a locale-specific restriction. That can violate language/locale policy when a skill implicitly forces one language for all users.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

update_cmd = None
    elif shutil.which("pacman"):
        pkg_manager = "pacman"
        install_cmd = ["pacman", "-S", "--noconfirm", "poppler"]
        update_cmd = None
    elif shutil.which("zypper"):
        pkg_manager = "zypper"

• Confidence: 92% confidence
• Finding: Using pacman with --noconfirm suppresses user review and enables unattended package installation decisions. In combination with a document-processing skill, this autonomy makes unauthorized host changes easier and removes a safety checkpoint.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

print("无法识别的包管理器，请手动安装 poppler-utils")
        return False

    # 判断是否需要 sudo
    sudo = []
    if os.geteuid() != 0:
        # 检查 sudo 是否可以无密码运行

• Confidence: 94% confidence
• Finding: The presence of sudo orchestration in a PPT skill indicates preparation for privileged operations beyond the tool's stated purpose. Even before execution, this design choice materially increases risk because it enables host-level changes from a low-trust document-processing path.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

return False

    # 判断是否需要 sudo
    sudo = []
    if os.geteuid() != 0:
        # 检查 sudo 是否可以无密码运行
        try:

• Confidence: 93% confidence
• Finding: This code path sets up privileged execution flow for later package installation. Within the context of a conversion skill, building in root-capable behavior is unnecessary and broadens the potential damage from misuse or compromise.

Static analysis

No suspicious patterns detected.