sn-ppt-workbench

• Outcome: Review
• Latest audit: Aug 19, 2026 · 3:25 AM UTC
• Version: 2026.8.19

Overview

This skill appears purpose-related, but it starts an unauthenticated local editing server that can modify files, use agent credentials, and may be exposed beyond localhost.

Install only if you intend to run a local PPT editing server and are comfortable with it modifying deck files, starting a detached Node process, and using configured agent/gateway credentials. Prefer localhost-only binding, avoid shared default keys, disable bridge/export features you do not need, and do not expose the port on untrusted networks.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (24)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill instructs the agent to read environment variables, inspect local filesystem paths, invoke shell commands, and expose a local web service, but it declares no permissions or equivalent safety contract. That mismatch increases the chance the skill is executed with broader capabilities than reviewers or users expect, reducing auditability and making misuse of local files, secrets, or network access harder to control.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill is presented as a local workbench opener, but it also configures agent integrations, resolves API keys, and prepares remote gateway connectivity. That scope expansion is dangerous because a user expecting only local preview/edit behavior may unknowingly trigger credential use and external service interaction.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The code searches local Hermes .env files and loads secret values into the process even though the advertised purpose is merely opening an existing deck. Reading local credential stores outside the minimum necessary scope creates unnecessary credential exposure and can silently broaden trust boundaries.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The script probes configured and fallback HTTP endpoints to detect a Hermes gateway base, which introduces undisclosed network activity unrelated to simply opening local HTML decks. This can leak metadata about local services and silently route subsequent workbench traffic toward remote or privileged endpoints.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The launcher is described as opening a previously generated local PPT deck, but it also accepts and propagates agent-provider settings, session identifiers, base URLs, ACP commands, and gateway/API credentials into the spawned server environment. That broadens the trust boundary from a local preview tool into a remote-capable bridge process, creating unnecessary secret exposure and increasing the chance the workbench can act on external services if the server or logs are compromised.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The code supports binding to 0.0.0.0/:: and constructing LAN or custom public URLs, which contradicts the skill description of merely opening a local PPT workbench. Exposing the workbench beyond localhost can allow other devices or forwarded endpoints to reach a UI that may contain deck contents, session state, and any attached bridge functionality.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The runtime exposes broad deck import, mutation, audit, packaging, and export capabilities despite the skill being described as a workbench opener only. This is dangerous because an agent invoking this skill can perform unintended state-changing operations and externalized export workflows far beyond least-privilege expectations, increasing the blast radius from simple preview to file overwrite, artifact generation, and workflow execution.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: This code launches Playwright/Chromium, runs screenshot and export helpers, and executes subprocesses from server endpoints, which exceeds the expected behavior of merely opening an editor UI. In an agent skill context, hidden process execution materially increases risk because any prompt-to-tool path can trigger local code execution primitives and filesystem side effects under the server's privileges.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The runtime forwards prompts, images, deck context, and related session data to external AI backends and agent companion sessions. This is dangerous because a supposedly local workbench-opening skill becomes a data exfiltration and remote-influence channel, sending slide contents and workspace metadata to external services and allowing those responses to shape local edits.

Context-Inappropriate Capability

Low

• Confidence: 93% confidence
• Finding: The CSS loads fonts from fonts.googleapis.com, which causes the local workbench to make outbound network requests and disclose usage metadata such as IP address, user agent, and timing to a third party. In a tool described as opening previously generated local PPT decks without needing external generation, this weakens privacy expectations and can also create reliability issues in restricted or air-gapped environments.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill explicitly recommends binding the workbench to 0.0.0.0 for remote/LAN access and notes Docker/WSL may do so by default, but it does not give a strong security warning about exposing an editing service to other hosts. If the workbench lacks authentication or is reachable on an untrusted network, unauthorized users could access slide content, manipulate decks, or potentially interact with agent-bridge features.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation repeatedly uses a reusable bearer token value (`ppt-editor-dev`) as the configured API key and even recommends setting both sides to that same weak, shared default. Although the service is described as loopback-only, this pattern normalizes insecure credentials and increases the chance the same key is reused in non-local, shared, or accidentally exposed environments, enabling unauthorized access to the Gateway API if the port becomes reachable.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Sensitive API keys are loaded from local env files and then forwarded to a child process without any user-facing disclosure or consent. Passing secrets into a child process expands exposure through process environments, logs, crash dumps, or downstream components the user did not intend to trust.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The launcher reads API keys and session IDs from CLI arguments and environment variables, then forwards them to a detached child process without any explicit user warning or need-to-know restriction. Even if not immediately leaked, this increases the exposure surface because secrets become available to the spawned server, its runtime environment, and potentially diagnostic outputs or future bugs in the workbench.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The service persists patched slide HTML directly to disk and updates deck metadata, enabling silent overwrite of deck content from API calls. In this skill context, that is more dangerous because users expect preview/open behavior, not unannounced modification of underlying files through the same runtime.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Export operations invoke external conversion subprocesses without any user-facing or server-side approval gate in this file. That is dangerous because export commands can execute code, touch arbitrary files, and unexpectedly leak deck contents into new artifacts, all from a runtime advertised as non-generative and non-exporting.

Missing User Warnings

Low

• Confidence: 79% confidence
• Finding: The runtime monkey-patches child_process spawning behavior globally to hide windows on Windows systems. While not an exploit by itself, globally altering subprocess behavior reduces transparency and can conceal command execution from users and operators, making unexpected process launches harder to notice and investigate.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: A shell command template is resolved and executed via execSync, creating a direct command-execution sink for export workflows. In an agent-accessible server, this is especially dangerous because environment or template misuse can turn a simple export action into arbitrary command execution or unauthorized filesystem access.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

parser = argparse.ArgumentParser(description="Open PPT editor WebUI for an existing HTML deck.")
    parser.add_argument("--deck-dir", default="")
    parser.add_argument("--search-root", action="append", default=[])
    parser.add_argument("--agent-session-id", default=os.environ.get("HERMES_SESSION_KEY", ""))
    parser.add_argument("--agent-managed", default=os.environ.get("WORKBENCH_AGENT_MANAGED", ""))
    parser.add_argument("--agent-provider", default=_default_agent_provider())
    parser.add_argument("--agent-transport", default=os.environ.get("WORKBENCH_AGENT_TRANSPORT", ""))

• Confidence: 79% confidence
• Finding: Defaulting --agent-session-id from HERMES_SESSION_KEY causes the skill to automatically ingest a session secret for a task that is supposed to open a local deck. In context, this broadens the operation from local UI launch to authenticated agent attachment without explicit user awareness.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

parser.add_argument("--agent-transport", default=os.environ.get("WORKBENCH_AGENT_TRANSPORT", ""))
    parser.add_argument("--agent-runtime", default=os.environ.get("WORKBENCH_AGENT_RUNTIME", _default_agent_provider()))
    parser.add_argument("--agent-base-url", default=os.environ.get("WORKBENCH_AGENT_BASE_URL", os.environ.get("OPENCLAW_GATEWAY_BASE_URL", os.environ.get("OPENCLAW_BASE_URL", ""))))
    parser.add_argument("--agent-api-key", default=os.environ.get("WORKBENCH_AGENT_API_KEY", os.environ.get("OPENCLAW_API_KEY", "")))
    parser.add_argument("--acp-command", default=os.environ.get("WORKBENCH_ACP_COMMAND", os.environ.get("CODEX_ACP_COMMAND", os.environ.get("CLAUDE_ACP_COMMAND", ""))))
    parser.add_argument("--webui-base-url", default=os.environ.get("HERMES_WEBUI_BASE_URL", ""))
    parser.add_argument("--gateway-base-url", default=os.environ.get("HERMES_GATEWAY_BASE_URL", ""))

• Confidence: 90% confidence
• Finding: The script automatically reads WORKBENCH_AGENT_API_KEY or OPENCLAW_API_KEY and uses it to configure agent connectivity, despite being described as a local PPT workbench opener. This is sensitive credential harvesting relative to the declared function and may authorize unintended remote access.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

parser.add_argument("--acp-command", default=os.environ.get("WORKBENCH_ACP_COMMAND", os.environ.get("CODEX_ACP_COMMAND", os.environ.get("CLAUDE_ACP_COMMAND", ""))))
    parser.add_argument("--webui-base-url", default=os.environ.get("HERMES_WEBUI_BASE_URL", ""))
    parser.add_argument("--gateway-base-url", default=os.environ.get("HERMES_GATEWAY_BASE_URL", ""))
    parser.add_argument("--gateway-api-key", default=os.environ.get("WORKBENCH_GATEWAY_API_KEY", ""))
    parser.add_argument("--public-url", default="")
    parser.add_argument("--host", default="")
    parser.add_argument("--port", default="0")

• Confidence: 91% confidence
• Finding: Auto-reading WORKBENCH_GATEWAY_API_KEY wires a server-side gateway secret into this operation with no transparency to the user. Because the skill’s stated scope is local deck opening, silently consuming high-value credentials is unnecessarily risky and can enable broader backend access than expected.

Credential Access

High

• Category: Privilege Escalation

Content

"""Yield Hermes env files that may contain the Gateway bridge secret."""
    value = _clean_env("HERMES_HOME")
    if value:
        yield Path(value).expanduser() / ".env"
    if os.name == "nt":
        local_app_data = os.environ.get("LOCALAPPDATA", "").strip()
        if local_app_data:

• Confidence: 95% confidence
• Finding: Including Hermes .env locations as credential sources is credential access behavior that exceeds the minimally necessary actions for opening a local workbench. In this context, it creates a real risk because it silently targets files likely to contain privileged API secrets.

Credential Access

High

• Category: Privilege Escalation

Content

if os.name == "nt":
        local_app_data = os.environ.get("LOCALAPPDATA", "").strip()
        if local_app_data:
            yield Path(local_app_data) / "hermes" / ".env"
    yield Path.home() / ".hermes" / ".env"

• Confidence: 95% confidence
• Finding: Probing LOCALAPPDATA/hermes/.env specifically targets a likely credential store and is unrelated to the narrow function of opening an existing local deck. That makes the behavior materially risky because it accesses secrets from a user profile area without clear necessity or consent.

Credential Access

High

• Category: Privilege Escalation

Content

local_app_data = os.environ.get("LOCALAPPDATA", "").strip()
        if local_app_data:
            yield Path(local_app_data) / "hermes" / ".env"
    yield Path.home() / ".hermes" / ".env"


def _load_env_file(file_path: Path) -> dict[str, str]:

• Confidence: 96% confidence
• Finding: Reading ~/.hermes/.env is another direct credential-access path that silently expands the trust boundary of a local workbench launcher. If the child runtime or any dependent code is compromised, these harvested secrets could be abused for unauthorized backend access.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.env_credential_access (+2 more)

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: workbench-runtime/bin/sensenova-ppt-workbench.mjs:466

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: workbench-runtime/dist-server/index.mjs:33609

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: workbench-runtime/dist-server/index.mjs:1030

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: workbench-runtime/bin/sensenova-ppt-workbench.mjs:122

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: workbench-runtime/dist-server/index.mjs:476

Potential obfuscated payload detected.

Warn

• Code: suspicious.obfuscated_code
• Location: workbench-runtime/dist-server/index.mjs:2578

Potential obfuscated payload detected.

Warn

• Code: suspicious.obfuscated_code
• Location: workbench-runtime/dist/assets/MarkdownArtifactViewer-0j-iJPy3.js:2

Sensitive-looking file read is paired with a network send.

Warn

• Code: suspicious.potential_exfiltration
• Location: workbench-runtime/bin/sensenova-ppt-workbench.mjs:84