sn-ppt-doctor

• Outcome: Review
• Latest audit: Aug 19, 2026 · 2:55 AM UTC
• Version: 2026.8.19

Overview

The skill appears to be a real PPT environment checker, but it handles API keys and runs locally discovered tooling in ways users should review before installing.

Install only if you trust the local sn-image-base runner and the workspace where this skill will run. Prefer setting API keys through your normal secret manager or process environment instead of letting the skill write a plaintext .env, and avoid running it in untrusted directories or with an SN_IMAGE_BASE value you did not set yourself.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

existing_pp = env.get("PYTHONPATH", "")
    env["PYTHONPATH"] = os.pathsep.join([skill_root, existing_pp]) if existing_pp else skill_root
    try:
        result = subprocess.run(
            [sys.executable, str(runner), "--help"],
            capture_output=True,
            text=True,

• Confidence: 89% confidence
• Finding: The diagnostic executes a discovered sibling script (sn_agent_runner.py) with the current process environment copied through, which may include API keys and other sensitive variables. Because the path is derived from environment and filesystem layout rather than a trusted allowlist or integrity check, a malicious or trojanized sibling skill could run attacker-controlled code and exfiltrate secrets during a seemingly harmless health check.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

)

    try:
        result = subprocess.run(
            ["npx", "playwright", "install", "--dry-run", "chromium"],
            capture_output=True, text=True, timeout=30,
            cwd=str(base),

• Confidence: 82% confidence
• Finding: The diagnostic invokes `npx playwright install --dry-run chromium`, which executes external tooling from the local Node/npm ecosystem. In an untrusted workspace or poisoned PATH/node_modules context, this can run attacker-controlled package scripts or binaries during a check that users may expect to be read-only.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares operational behavior that includes reading environment variables, writing a .env file, reading files, and invoking shell commands, but no explicit permissions are declared in the manifest. That mismatch weakens policy enforcement and user visibility, making it easier for a skill with credential and shell access to run with broader capabilities than reviewers or users expect.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: This check validates availability by actually running sibling skill code, expanding the trust boundary from the doctor script to whatever sits at the discovered runner path. In this skill context, users are likely to treat a doctor command as safe and informational, making hidden execution of adjacent skill code more dangerous because it can trigger arbitrary behavior and secret exposure unexpectedly.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The optional dependency check launches `npx playwright ...`, which is more than passive inspection and may execute code from local package resolution or a compromised toolchain. Because this occurs in a diagnostic workflow, it violates the expectation that the doctor merely reports status and increases supply-chain and local execution risk.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The script interactively prompts for an API key and persists it to `.env` without a prominent warning about plaintext-at-rest storage, file location, or permission implications. In practice this can cause users to store production credentials in insecure workspace directories or repositories, especially since the tool encourages doing so as remediation.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The function prompts for an API key and persists it to a .env file on disk without any explicit warning, confirmation, or guidance about file permissions and long-term storage. This creates a real secret-handling weakness because users may unknowingly leave sensitive credentials in plaintext where they can be exposed via backups, repo commits, shared workspaces, or overly broad filesystem access.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

detail="sn_agent_runner.py not found; see check_sn_image_base_discoverable",
        )
    skill_root = str(runner.parent.parent)
    env = os.environ.copy()
    existing_pp = env.get("PYTHONPATH", "")
    env["PYTHONPATH"] = os.pathsep.join([skill_root, existing_pp]) if existing_pp else skill_root
    try:

• Confidence: 90% confidence
• Finding: Copying the full process environment and forwarding it into execution of another script unnecessarily exposes all inherited secrets to that child process. Combined with dynamic sibling-path execution, this materially increases the chance of credential harvesting if the runner is malicious, replaced, or unexpectedly behaves insecurely.

Credential Access

High

• Category: Privilege Escalation

Content

name: sn-ppt-doctor
description: |
  Environment diagnostic for the PPT family. Validates sn-image-base, API keys,
  Node runtime, and optional deps; interactively writes .env for required vars.
  Runs before sn-ppt-entry; does not modify sn-image-* skills.
metadata:
  project: SenseNova-Skills

• Confidence: 82% confidence
• Finding: The skill explicitly validates API keys and interactively writes them into a .env file, which means it handles secrets and persists them to disk. Even though this appears intended for setup rather than exfiltration, secret collection and storage increase exposure risk through accidental disclosure, overbroad file access, weak file permissions, or downstream misuse by other tools.

Credential Access

High

• Category: Privilege Escalation

Content

from dotenv import load_dotenv
    _script = Path(__file__).resolve()
    _repo_root = _script.parents[3]
    for _candidate in (_repo_root / ".env", _repo_root / "skills" / ".env", Path.cwd() / ".env"):
        if _candidate.exists():
            load_dotenv(_candidate, override=False)
except ImportError:

• Confidence: 78% confidence
• Finding: Because this is a diagnostic skill that later reports environment status, implicit loading of .env files from cwd makes the context more sensitive: a poisoned workspace can influence what credentials and paths the doctor sees. That raises the risk of configuration confusion and trust-boundary violations, especially since the skill is intended to run interactively before other tooling.

Credential Access

High

• Category: Privilege Escalation

Content

from dotenv import load_dotenv
    _script = Path(__file__).resolve()
    _repo_root = _script.parents[3]
    for _candidate in (_repo_root / ".env", _repo_root / "skills" / ".env", Path.cwd() / ".env"):
        if _candidate.exists():
            load_dotenv(_candidate, override=False)
except ImportError:

• Confidence: 78% confidence
• Finding: Because this is a diagnostic skill that later reports environment status, implicit loading of .env files from cwd makes the context more sensitive: a poisoned workspace can influence what credentials and paths the doctor sees. That raises the risk of configuration confusion and trust-boundary violations, especially since the skill is intended to run interactively before other tooling.

Credential Access

High

• Category: Privilege Escalation

Content

from dotenv import load_dotenv
    _script = Path(__file__).resolve()
    _repo_root = _script.parents[3]
    for _candidate in (_repo_root / ".env", _repo_root / "skills" / ".env", Path.cwd() / ".env"):
        if _candidate.exists():
            load_dotenv(_candidate, override=False)
except ImportError:

• Confidence: 78% confidence
• Finding: Because this is a diagnostic skill that later reports environment status, implicit loading of .env files from cwd makes the context more sensitive: a poisoned workspace can influence what credentials and paths the doctor sees. That raises the risk of configuration confusion and trust-boundary violations, especially since the skill is intended to run interactively before other tooling.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.