Security audit

Text to PPT

Security checks for vulnerabilities and agentic risk

Overview

This presentation skill is purpose-aligned, but it needs Review because it writes output to a fixed Obsidian path and creates active HTML presentations that load remote code without enough disclosure or safeguards.

Install only if you are comfortable with generated decks writing to the hard-coded Obsidian path unless overridden, opening presentations that load third-party CDN resources, and converting only trusted files or URLs. Avoid using attacker-controlled web pages or sensitive notes as input until the skill adds destination confirmation, dependency pinning or vendoring, and HTML sanitization.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: references/shell-template.html:7
Finding: Generated presentations execute mutable third-party CDN dependencies
Content: View full analysis
``` ```css @import url('https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700;800;900&display=swap'); ``` ### Technical Analysis Every generated presentation loads JavaScript, CSS, and fonts from multiple external services when opened. The Tailwind URL has no explicit version, while the Chart.js dependencies are pinned only to major versions. None of the dependencies uses Subresource Integrity, and the resources are not vendored into the generated artifact. Consequently, the effective code executed by a presentation can change after the Skill has been reviewed. The generated artifact is therefore not genuinely self-contained, despite the output being described as a “single self-contained HTML file” in `SKILL.md`. A compromised CDN account, upstream release, distribution endpoint, or network resolution path could cause arbitrary JavaScript supplied by the affected dependency source to execute in the presentation's browser context. The remote font and stylesheet requests also disclose connection metadata, including the viewer's IP address and user agent, to third-party providers. ### Attack Path 1. The Skill generates an HTML presentation using `shell-template.html`. 2. A dependency publisher, CDN endpoint, or relevant delivery path is compromised, or a mutable dependency URL begins serving a malicious release. 3. A user opens the ...[truncated 1113 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:57
Finding: Untrusted source content can be incorporated into executable HTML without required sanitization
Content: View full analysis
` block. **For each slide, the agent should:** 1. Take ONE slide from the plan (by number) 2. Read only the design system reference if not already loaded 3. Generate ONLY that one slide's HTML `
...
` 4. No ``, no ``, no `` — just the slide div ``` ```text ## Input Sources - Directly pasted text - A file path — read it first with `read` - A URL — fetch it first with `web_fetch` - An Obsidian note path — read it first ``` ```html ``` The sub-agent instructions also explicitly permit scripts inside generated slide blocks: ```text OUTPUT: Return ONLY a single
...
block. No , , or tags. Use inline styles. Include
Remediation: View remediation
`, ``, `<object>`, and `<embed>` elements. - Inline event handlers such as `onclick`, `onload`, and `onerror`. - `javascript:`, unsafe `data:`, and other dangerous URL schemes. - Unexpected external resource references. 4. Move all chart initialization into trusted shell code. Slide blocks should contain declarative chart data rather than executable scripts. 5. Validate hyperlinks and external resources against an explicit scheme and domain allowlist. 6. Add a restrictive Content Security Policy that blocks unauthorized inline scripts, plugins, frames, and network destinations. 7. Add a final security-validation phase after slide assembly and before writing the output file. 8. Include adversarial tests using source content containing HTML tags, event handlers, dangerous URLs, embedded resources, and prompt-injection-style instructions. 9. Warn users before preserving external links or other active content from untrusted source material. ]]>

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.
md
1. Read the shell template from `references/shell-template.html`

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest uses very broad activation criteria covering many generic requests about presentations and arbitrary text conversion. Overbroad triggering increases the chance the skill is invoked in contexts the user did not intend, which can indirectly lead to unexpected file reads, URL fetches, or file writes defined elsewhere in the skill.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill hard-codes saving output to ~/Documents/longhai/Longhai/, causing writes to a fixed local path unrelated to the generic skill purpose. Unprompted filesystem writes to a predetermined location can surprise users, overwrite existing content, or disclose environment-specific assumptions that are unsafe outside the author's machine.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs the agent to save generated files to a fixed Obsidian vault path without warning or confirmation. Silent persistence to a local directory is dangerous because it creates side effects the user may not expect and can place files into sensitive note repositories automatically.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill explicitly allows fetching arbitrary URLs via web_fetch, which expands a text-to-presentation skill into a network-capable data-ingestion tool. This can cause unintended outbound requests, expose sensitive browsing targets, and process untrusted remote content without clear user consent, making prompt-injection and data-handling risks more likely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill permits fetching remote URLs as input but does not prominently warn the user that network access will occur. This is risky because loading attacker-controlled web content can trigger prompt-injection attempts and because even benign fetches may reveal metadata or access patterns unexpectedly.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The HTML document sets lang="zh-CN", which enforces a specific language/locale in the template. Under the policy, locale constraints should offer user choice or be clearly documented as region-specific; neither is present in this file.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The template loads executable JavaScript and styles from multiple public CDNs (Tailwind, Chart.js, plugin, Font Awesome, Google Fonts). This creates a supply-chain and privacy risk: if a CDN asset is compromised, changed unexpectedly, blocked, or observed by a third party, generated presentations can execute untrusted code or leak usage metadata when opened.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The Phase 1 JSON template specifies "language": "zh-CN", which can steer output toward a fixed locale. The document does not state that language is user-selectable or that the skill is intentionally limited to a China-specific context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The component snippets hard-code English placeholder labels such as "Label" and percentage/status text, and the guidance presents them as default output patterns. Because the file does not indicate user language selection or locale flexibility, this can be read as forcing a single language convention.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.