Back to skill

Security audit

aippt

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent PPT-generation skill, but it relies on a third-party API and an access token, so users should avoid sending sensitive content unless they trust that service.

Install only if you are comfortable sending the generated Markdown, including any content derived from your documents, to the jcppt/7niuai PPT service. Treat AIPPT_ACCESS_TOKEN as a secret: do not commit it, paste it into chats, or include it in screenshots, and rotate it if exposed.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (16)

Tp4

High
Category
MCP Tool Poisoning
Confidence
89% confidence
Finding
该代码与“生成 PPT”这一大方向相关,但描述显著宽于实际实现。代码唯一明确支持的输入是 markdown_content 和 tpl_id,然后调用外部 PPT 生成接口;没有文件解析、图片处理、docx 处理、或对篇幅/场景/语气/角色等参数的接收与转换逻辑。因此,虽然主领域一致(PPT 生成),但声明的关键能力并未被此代码体现,属于描述与行为不完全一致,且存在实质性能力夸大。

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
声明描述的核心能力是一键生成 PPT,并依据用户要求和文件内容生成演示文稿;而提供的代码块只是一个简单的模板列表获取脚本,调用 https://ppt-api.7niuai.com/ppt/tpl/list 接口并返回模板数据。其主要目的与“自动生成 PPT”明显不同,且代码中没有任何生成 PPT、解析用户输入、处理 docx/图片文件的逻辑。因此该代码与声明用途存在明显不匹配。

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill explicitly supports generating PPTs from user content and referenced files, and it instructs use of external services, but it does not clearly warn that uploaded files/content may be sent off-platform for processing. This creates a significant privacy and data-governance risk, especially if users provide sensitive documents, images, or internal materials.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The README tells users to copy an ACCESS_TOKEN into an environment variable but does not clearly label it as a sensitive secret or warn against exposing it in logs, screenshots, repositories, or shared config files. Because this skill is designed to be installed and configured by users, weak secret-handling guidance increases the chance of credential leakage and unauthorized use of the associated AIPPT account or API access.

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill declares access to environment variables and relies on external networked scripts, but it does not define an explicit tool scope or allowed-tools boundary. That increases the chance of over-broad execution or future tool misuse because the runtime permissions are implicit rather than constrained.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger phrases are very broad and include common requests like '生成一个PPT', which can cause the skill to activate in situations the user did not intend. Because the skill may use external services and user content, accidental invocation can lead to unintended data transmission or confusing autonomous actions.

External Transmission

Medium
Category
Data Exfiltration
Content
### 请求示例
```bash
curl --location 'https://ppt-api.7niuai.com/ppt/tpl/list' \
--header 'X-Platform: web' \
--header 'Content-Type: application/json' \
--data '{
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The documentation instructs clients to send user-provided Markdown content to a third-party API that generates PPTs, but it does not warn that the content may contain sensitive business, personal, or regulated data. In this skill’s context, users are explicitly encouraged to provide rich content and files for slide generation, so silent external transmission creates a real privacy and compliance risk.

External Transmission

Medium
Category
Data Exfiltration
Content
### 请求示例
```bash
curl --location 'https://ppt-api.7niuai.com/openclaw/generate_by_content' \
--header 'token: ODk4Nzg2YMjRmNDM=' \
--header 'Content-Type: application/json' \
--data '{
Confidence
97% confidence
Finding
The example shows sending user-controlled Markdown to an external endpoint and includes a hardcoded token in the request header. In the context of a PPT-generation skill that may process user files and detailed prompts, this creates both data-exfiltration/privacy exposure and credential leakage risk if the token is real or reused.

External Transmission

Medium
Category
Data Exfiltration
Content
"markdown_content": content
    }

    response = requests.post(url, json=param, headers=headers)
    return response.json()

if __name__ == "__main__":
Confidence
91% confidence
Finding
This code performs external transmission of user content to a remote API endpoint, which is a genuine data-exposure concern in a skill that may process uploaded documents or sensitive Markdown. Although the network call is the intended product behavior, the security risk arises from sending potentially sensitive material off-box without trust boundary documentation, validation, or explicit user awareness.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script sends user-supplied Markdown content to a third-party remote API without any visible disclosure, consent flow, or data minimization. Because PPT generation may involve sensitive business or personal content, this can cause unanticipated external data exposure even if the transmission is functionally required by the skill.

External Transmission

Medium
Category
Data Exfiltration
Content
"num": num
    }

    response = requests.post(url, json=param, headers=headers)
    return response.json()

if __name__ == "__main__":
Confidence
80% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Low
Confidence
90% confidence
Finding
The only natural-language description in the file is written in Chinese, with no indication that language selection is optional or region-specific. This can violate language or locale policy when a skill implicitly forces a specific language without offering user choice or documenting the constraint.

Natural-Language Policy Violations

Low
Confidence
83% confidence
Finding
The module docstring describes the script only in Chinese, and the CLI description/help text is also not presented as an opt-in language choice. Under the policy, hard-coding a specific language can be a natural-language policy issue when no user choice or justified locale constraint is provided.

Missing User Warnings

Low
Confidence
89% confidence
Finding
This code sends data to a remote API using requests.post, but the script provides no print/log message, confirmation, or inline warning that user-supplied arguments will be transmitted off-host. For a code file, network transmission is a safety-relevant operation that should include at least some visible disclosure to the user.

Natural-Language Policy Violations

Low
Confidence
80% confidence
Finding
The script's argparse description and help strings are user-facing interface text, but they do not offer any language selection or explain a locale-specific scope. This can violate the language-choice policy for natural-language content embedded in code.

Static analysis

No suspicious patterns detected.