sn-ppt-standard

• Outcome: Review
• Latest audit: Aug 19, 2026 · 3:16 AM UTC
• Version: 2026.8.19

Overview

This presentation skill is mostly coherent, but its workbench bridge automatically looks for and forwards local credentials in ways users should review before installing.

Review this before installing if you work with confidential presentations or shared developer machines. It can send deck content and images to configured model services, create and overwrite deck files, launch a local workbench, and automatically use local Hermes/OpenClaw-style credentials for bridge mode. Prefer explicit, narrowly scoped credentials and an isolated project environment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill instructs the agent to use shell execution, file reads/writes, environment variables, and networked services, but the manifest exposes no declared permissions or capability boundaries. This creates a mismatch between what reviewers/users can infer and what the skill actually does, increasing the chance of over-privileged execution and unsafe deployment in environments that rely on manifest declarations for policy.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The fallback path tells the agent to bypass the advertised single-CLI pipeline and directly author core artifacts such as outline.json and page HTML files. That materially expands the skill's authority and behavior surface, making it easier for an agent to perform unsupervised file generation/modification outside the intended controlled wrapper and weakening assumptions about validation and safety checks enforced by run_stage.py.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The document claims generation logic stays in run_stage.py and the skill is self-contained, but later authorizes the agent to generate outputs with its own LLM and write files directly. This inconsistency is dangerous because operators may trust the wrapper as the sole enforcement point, while the skill actually permits bypassing it during failure conditions.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: This code searches local Hermes .env files, parses secrets, and injects API keys into the current process environment even when the user did not explicitly supply them. In a skill whose stated role is launching a PPT workbench, automatic credential harvesting from unrelated local config broadens access to sensitive secrets and can expose them to downstream child processes.

Context-Inappropriate Capability

Low

• Confidence: 86% confidence
• Finding: The launcher performs authenticated HTTP probes against configured and fallback local endpoints to determine whether they are Hermes gateway instances. This adds network behavior and credential use beyond simply starting a local UI, and can leak metadata or unintentionally contact services the user did not expect the skill to query.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill instructs direct writes to deck JSON/HTML artifacts, including manual edits to info_pack.json and page files, without prominently disclosing in the user-facing description that local deck files will be modified. This can lead to unexpected persistence, accidental corruption of project artifacts, and reduced user awareness when an agent is making substantial file changes on disk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The VLM helper reads arbitrary local image files, base64-encodes them, and sends their full contents to a remote model endpoint. In a presentation-generation skill, local slides, screenshots, or exported images may contain confidential business data, so this creates a real data-exfiltration risk if callers pass sensitive paths without explicit consent or policy checks.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The LLM client transmits system and user prompts to an external chat-completions endpoint. While remote inference is expected for an LLM client, prompts in this skill may contain proprietary slide content, notes, research, or user data, so lack of explicit disclosure and guardrails makes accidental data exposure possible.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: These routines resolve sensitive gateway/API keys from multiple environment sources and then make them available for later propagation to a Node child process, without user-facing disclosure or consent. Passing broad-scope credentials to another runtime increases the blast radius if the child process, its dependencies, or logs are compromised.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The script makes authenticated HTTP requests using a gateway API key during endpoint discovery without prominently surfacing that behavior. Even though this is intended for local gateway detection, using credentials in silent network probes can surprise users and may disclose token validity or trigger requests to unintended endpoints.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The refine workflow sends both a rendered slide screenshot and the full HTML source to a VLM for critique. If slide content contains sensitive business data, embedded notes, local file references, or proprietary markup, this transmits more information to an external model service than is necessary and does so without any operation-site consent gate or redaction step.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

parser.add_argument("--agent-transport", default=os.environ.get("WORKBENCH_AGENT_TRANSPORT", ""))
    parser.add_argument("--agent-runtime", default=os.environ.get("WORKBENCH_AGENT_RUNTIME", _default_agent_provider()))
    parser.add_argument("--agent-base-url", default=os.environ.get("WORKBENCH_AGENT_BASE_URL", os.environ.get("OPENCLAW_GATEWAY_BASE_URL", os.environ.get("OPENCLAW_BASE_URL", ""))))
    parser.add_argument("--agent-api-key", default=os.environ.get("WORKBENCH_AGENT_API_KEY", os.environ.get("OPENCLAW_API_KEY", "")))
    parser.add_argument("--acp-command", default=os.environ.get("WORKBENCH_ACP_COMMAND", os.environ.get("CODEX_ACP_COMMAND", os.environ.get("CLAUDE_ACP_COMMAND", ""))))
    parser.add_argument("--webui-base-url", default=os.environ.get("HERMES_WEBUI_BASE_URL", ""))
    parser.add_argument("--gateway-base-url", default=os.environ.get("HERMES_GATEWAY_BASE_URL", ""))

• Confidence: 90% confidence
• Finding: This option implicitly sources an agent API key from environment variables, enabling the launcher to consume and forward credentials without explicit user action. In the context of a presentation-generation skill, silent credential capture is more dangerous because it exceeds the minimum expected capability and feeds secrets into downstream processes.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

parser.add_argument("--acp-command", default=os.environ.get("WORKBENCH_ACP_COMMAND", os.environ.get("CODEX_ACP_COMMAND", os.environ.get("CLAUDE_ACP_COMMAND", ""))))
    parser.add_argument("--webui-base-url", default=os.environ.get("HERMES_WEBUI_BASE_URL", ""))
    parser.add_argument("--gateway-base-url", default=os.environ.get("HERMES_GATEWAY_BASE_URL", ""))
    parser.add_argument("--gateway-api-key", default=os.environ.get("WORKBENCH_GATEWAY_API_KEY", ""))
    parser.add_argument("--public-url", default="")
    parser.add_argument("--host", default="")
    parser.add_argument("--port", default="0")

• Confidence: 92% confidence
• Finding: This line defaults the gateway API key from process environment, contributing to implicit secret harvesting and later propagation to the child Node launcher. Because the script also performs gateway probing and child-process execution, automatic credential intake materially raises the risk of unintended secret use or exposure.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def _subprocess_env() -> dict[str, str]:
    env = os.environ.copy()
    env.setdefault("PYTHONIOENCODING", "utf-8")
    env.setdefault("PYTHONUTF8", "1")
    return env

• Confidence: 74% confidence
• Finding: The helper copies the entire parent process environment into every subprocess, including Node tools and sibling skill runners. In an agent environment, this can unintentionally propagate API keys, tokens, proxy settings, and other secrets to child processes that do not need them, increasing exposure if those tools log, crash, or are compromised.

Credential Access

High

• Category: Privilege Escalation

Content

for name in ("HERMES_HOME",):
        value = _clean_env(name)
        if value:
            yield Path(value).expanduser() / ".env"
    if os.name == "nt":
        local_app_data = os.environ.get("LOCALAPPDATA", "").strip()
        if local_app_data:

• Confidence: 96% confidence
• Finding: Enumerating Hermes .env locations is preparatory credential access behavior: it is designed to locate local secret stores for later parsing and use. In this skill context, that is more concerning because secret-file discovery is not necessary for merely emitting or launching PPT workflow commands.

Credential Access

High

• Category: Privilege Escalation

Content

if os.name == "nt":
        local_app_data = os.environ.get("LOCALAPPDATA", "").strip()
        if local_app_data:
            yield Path(local_app_data) / "hermes" / ".env"
    yield Path.home() / ".hermes" / ".env"

• Confidence: 96% confidence
• Finding: This path targets a Windows-local Hermes .env file that may contain gateway secrets, enabling the launcher to access credentials outside the immediate task scope. The capability expands the script from launching a UI into harvesting local secret material for reuse.

Credential Access

High

• Category: Privilege Escalation

Content

local_app_data = os.environ.get("LOCALAPPDATA", "").strip()
        if local_app_data:
            yield Path(local_app_data) / "hermes" / ".env"
    yield Path.home() / ".hermes" / ".env"


def _load_env_file(file_path: Path) -> dict[str, str]:

• Confidence: 97% confidence
• Finding: Targeting ~/.hermes/.env is direct secret-file discovery in a user home directory, and the surrounding code subsequently parses and imports those values. This creates a clear pathway for credential access and reuse beyond the narrowly described presentation-workbench function.

Known Vulnerable Dependency: echarts==5.4.3 — 1 advisory(ies): CVE-2026-45249 (Apache ECharts has a cross-site scripting (XSS) vulnerability)

Low

• Category: Supply Chain
• Confidence: 86% confidence
• Finding: This file declares echarts 5.4.3, which is flagged as affected by a known XSS advisory. In this skill, ECharts is used to generate charts for presentation export; if chart configuration, labels, tooltips, or other rendered content can incorporate untrusted text and be rendered in an HTML/browser context during export or preview, the vulnerable library could enable script execution or malicious markup injection.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/export_pptx/lib/browser_setup.mjs:67