sn-ppt-entry

• Outcome: Pass
• Latest audit: Aug 19, 2026 · 2:57 AM UTC
• Version: 2026.8.19

Overview

This PPT-generation entry skill is coherent and disclosed, but users should understand that it parses uploaded documents, writes deck artifacts, starts a local progress UI when possible, and calls downstream model helpers.

Install only if you are comfortable with a skill that processes uploaded PDFs/DOCX/MD/TXT files, extracts document images, calls model APIs for document/image understanding, writes generated artifacts under the workspace, and may start a local progress workbench. Use trusted PPT_STANDARD_DIR/sn-ppt-standard installations and consider pinning parser dependencies before handling untrusted documents at scale.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill clearly performs environment access and filesystem reads/writes but does not declare permissions. That creates a capability/expectation gap: operators and policy systems may treat it as lower-risk than it is, while the skill can still process local files and write generated artifacts. In a skill that handles user-supplied paths, documents, and dispatch logic, undeclared file/env capabilities materially increase the chance of unsafe execution or poor sandboxing decisions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 84% confidence
• Finding: The manifest presents this as an entry/dispatch skill, but the body also performs document parsing, metadata persistence, and image captioning via model calls. That mismatch can cause reviewers or orchestrators to grant/approve it under a less risky mental model, even though it processes files and invokes additional components. Hidden or understated behavior is especially risky in agent skills because activation can be broad and chained.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The script imports executable Python code from a path influenced by the PPT_STANDARD_DIR environment variable after only checking that model_client.py exists there. If an attacker can control that environment variable or place a malicious model_client.py in a searched location, arbitrary code will execute at import time under the agent's privileges.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The activation criteria are broad enough to match ordinary conversation about making presentations, which increases the chance the skill triggers unexpectedly. Because this skill performs file operations, document parsing, WebUI launch attempts, and downstream dispatch, over-broad triggering expands the attack surface for prompt injection, unintended actions, and accidental processing of user files.

Natural-Language Policy Violations

High

• Confidence: 86% confidence
• Finding: Forcing language inference without user confirmation can cause the system to generate artifacts in the wrong language and silently encode an incorrect preference into persisted task metadata. In an agent workflow that writes task files and dispatches automatically, silent defaults create integrity and user-intent risks, especially when defaulting to Simplified Chinese on uncertainty.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pypdf>=4.0
python-docx>=1.1

• Confidence: 95% confidence
• Finding: The dependency is specified with a lower-bound range (`pypdf>=4.0`) instead of an exact pinned version, which makes builds non-reproducible and can unexpectedly pull in a vulnerable or breaking release. In this skill, that risk matters more because uploaded PDF files are parsed, so dependency behavior directly affects untrusted file handling.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pypdf>=4.0
python-docx>=1.1

• Confidence: 92% confidence
• Finding: `python-docx>=1.1` is also unpinned, creating supply-chain and reproducibility risk because future installs may resolve to different versions with different security posture. Since this skill parses uploaded DOCX files from users, dependency drift could expose the system to parser-related bugs in newly resolved versions.

Known Vulnerable Dependency: pypdf==4.0 — 10 advisory(ies): CVE-2026-48156 (pypdf: Possible long runtimes for zero-only width values in cross-reference stre); CVE-2026-24688 (pypdf has possible Infinite Loop when processing outlines/bookmarks); CVE-2026-27628 (pypdf has a possible infinite loop when loading circular /Prev entries in cross-) +7 more

Low

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: The finding indicates `pypdf` 4.0 has multiple advisories, including infinite-loop and long-runtime conditions while processing crafted PDFs. Because this skill explicitly accepts and parses uploaded PDF files, an attacker could supply a malicious document to trigger denial of service, tying up CPU or hanging processing.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.