Security audit

sn-ppt-creative

Security checks across malware telemetry and agentic risk

Overview

This skill’s behavior is coherent for generating creative PowerPoint decks, with disclosed model/image-generation steps and limited hygiene notes around logs and dependency pinning.

Reasonable to install if you are comfortable sending deck content and reference images through the configured model/image-generation pipeline. Avoid putting secrets in prompts or reference material, and consider pinning python-pptx plus redacting sanitize diagnostics for sensitive business decks.

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The script logs removed prompt fragments to stderr, and those fragments may contain sensitive or proprietary prompt content that was stripped before being sent downstream. In this skill context, stderr is intentionally preserved in execution logs for later inspection, so prompt data that users would not expect to be retained or exposed can be leaked to operators, logs, or adjacent systems.

Unpinned Dependencies

Low

Category: Supply Chain
Content: python-pptx>=0.6.21
Confidence: 92% confidence
Finding: The dependency is specified with only a lower bound, which allows future unreviewed versions of python-pptx to be installed. This can introduce supply-chain risk through breaking changes or newly introduced vulnerable releases, especially in automated or reproducible build environments.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.