Wisely Read PPT

• Outcome: Review
• Latest audit: Jul 26, 2026 · 7:18 AM UTC
• Version: 1.0.0

Overview

The skill appears to perform the advertised PPT/PDF-to-Word parsing, but its runtime dependency installer can silently modify the Python environment in a way users should review first.

Review before installing or running. Prefer running this skill in an isolated virtual environment or container, preinstall dependencies yourself, and use --no-install. Do not process highly sensitive decks or PDFs unless you are comfortable with screenshots, extracted images, and text being retained in the workspace until manually cleaned up.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (6)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

]
    for base in pip_cmds:
        try:
            r = subprocess.run(base + pkgs,
                               stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
                               timeout=180)
            if r.returncode == 0:

• Confidence: 90% confidence
• Finding: r = subprocess.run(base + pkgs, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, timeout=180)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill instructs use of shell commands, file reads/writes, environment checks, and subprocess-style workflow orchestration, yet it declares no permissions. This creates a trust and review gap: operators may invoke the skill without realizing it can modify the workspace, inspect local files, and execute commands such as package installation and document conversion.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior goes beyond simple PPT/PDF parsing by permitting automatic dependency installation via pip and generating persistent sidecar artifacts in the workspace. Auto-installation can execute unreviewed package code and introduces supply-chain risk, while undocumented artifact creation and placeholder outputs can mislead users about completeness and safety of the produced document.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: Auto-installing Python packages at runtime is a real supply-chain and environment-integrity risk because it executes package installation logic and may pull code from external repositories during normal skill execution. This is especially risky in agent environments where users may not expect the skill to mutate the system or access the network.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill explicitly creates persistent working and final directories and retains intermediate materials for audit, but does not require a user-facing warning or consent for disk usage and residual data retention. Because these artifacts can include screenshots, extracted text, and embedded images from sensitive documents, silent persistence increases confidentiality and data-retention risk.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The install flow escalates from user install to normal install and then to --break-system-packages, which can alter system-managed Python packages and weaken host integrity. Because it happens silently and without confirmation, it can unexpectedly change the runtime, break platform guarantees, or introduce malicious dependency code if the package source is compromised.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.