Wisely Read PPT

• Outcome: Review
• Latest audit: Jul 29, 2026 · 4:00 PM UTC
• Version: 1.3.1

Overview

The skill appears intended to parse PPT/PDF files, but it also allows automatic software installation, persistent environment changes, and retained copies of document contents that users should review first.

Install only if you are comfortable with the skill running local commands, installing dependencies, using LibreOffice/poppler tooling, spawning subagents for large jobs, and leaving extracted copies of your PPT/PDF content in working folders. Prefer using an isolated environment, preinstalling dependencies yourself, running with --no-install where possible, and deleting ppt-parse-working when you no longer need the audit artifacts.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

]
    for base in pip_cmds:
        try:
            r = subprocess.run(base + pkgs,
                               stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
                               timeout=180)
            if r.returncode == 0:

• Confidence: 92% confidence
• Finding: The script automatically executes pip install for missing packages at runtime, including a fallback to --break-system-packages, without user confirmation. This expands the skill's behavior from document parsing into package installation and causes execution of code fetched from package repositories, which can alter the host environment and increase supply-chain risk.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares no permissions, yet its instructions clearly require shell execution, environment inspection, and filesystem read/write. This under-disclosure is dangerous because operators or policy layers may treat it as low-risk parsing logic while it actually has broader system interaction capability, including installing software and creating persistent artifacts.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill advertises a document parsing workflow but also performs system/package installation, invokes multiple external tools, and persists large intermediate outputs. This mismatch is risky because users may consent to benign file conversion while the skill changes the host environment and leaves behind extracted sensitive content not reflected in the high-level description.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill instructs automatic installation of system packages as part of normal execution, which exceeds a typical document parsing scope and can modify the host without clear user approval. Even if intended for functionality, this expands attack surface, can break systems, and may violate least-privilege expectations for a content-processing skill.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The macOS guidance includes downloading software from the internet, mounting disk images, copying applications, and altering PATH via symlinks. For a local parsing skill, this is especially dangerous because it normalizes network retrieval and installation steps from within the skill context, creating supply-chain and persistence risks well beyond document processing.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Automatically installing Python dependencies during parsing adds environment-changing behavior that is not essential to the immediate act of analyzing a supplied document. This can introduce unreviewed code into the environment, create reproducibility issues, and expand compromise opportunities through package ecosystem abuse.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Auto-installing Python dependencies is outside the declared function of parsing PPT/PDF files and silently modifies the execution environment. In an agent skill context, this is risky because users invoking a file parser would not reasonably expect network/package-management side effects or host-level changes.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill explicitly retains working directories containing screenshots, extracted images, and structured text, but the description does not warn users that potentially sensitive document content will be duplicated and persisted. In a document-processing context, this materially increases confidentiality risk because private presentations or PDFs may remain on disk in multiple recoverable forms.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The guide instructs users to append a PATH modification to shell startup files, which creates a persistent environment change affecting future shells. While not inherently malicious, persistent PATH changes can cause unexpected command resolution behavior or interfere with other tooling if users are not clearly warned about the scope of the change.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The code performs unattended pip installation and even attempts --break-system-packages, which can override distribution-managed protections and modify the system Python environment. In a skill that processes untrusted documents, adding implicit package installation materially increases the blast radius from simple file parsing to environment compromise via dependency or repository abuse.

Static analysis

No suspicious patterns detected.