article-html-to-ppt

• Outcome: Review
• Latest audit: Aug 11, 2026 · 7:11 AM UTC
• Version: 3.0.2

Overview

The skill is a mostly disclosed local PowerPoint builder, but it needs Review because it instructs agents to run freshly generated Python, auto-routes some requests into bundled PMO builders, and ships assets marked for private-owner installation rather than public registry upload.

Install only if you trust the publisher and can run it in an isolated workspace. Prefer the IR/pipeline path for normal use, require explicit confirmation before Path A code execution or PMO auto-routing, review generated scripts before running them, and remove or opt out of the branded disclaimer slide for sensitive or client-facing decks.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

return RenderResult("unavailable", self.name, None, None, errors=["RENDER_ENGINE_UNAVAILABLE"], duration_seconds=elapsed_since(started))

        try:
            completed = subprocess.run(
                _powerpoint_export_command(pptx_path, pdf_path),
                text=True,
                stdout=subprocess.PIPE,

• Confidence: 89% confidence
• Finding: The renderer opens an attacker-controlled PPTX in Microsoft PowerPoint via AppleScript and exports it to PDF. While there is no shell injection because `subprocess.run` is called with an argument list, this still crosses a trust boundary into a large GUI application and may trigger macro execution, external resource fetching, or exploitation of PowerPoint/parser vulnerabilities when processing untrusted files.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill text describes substantial capabilities including file read/write, shell execution, environment probing, and optional network/cloud export, yet there is no formal permission declaration. This creates a trust and review gap: downstream systems or users may grant or assume fewer capabilities than the skill actually directs the agent to use, increasing the chance of unsafe execution in a broader environment.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The skill says subprocesses should be limited to user-approved builders/renderers, but later instructs automatic routing to a PMO builder based on heuristic keyword detection. That contradiction can cause execution of a different build path than the user explicitly requested or expected, which is dangerous when the routed path invokes local scripts and writes output.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The adapter injects hardcoded branded text into generated presentations, which modifies user content beyond the declared build/render function. In an agent setting, silent content insertion is dangerous because it can leak vendor identity, add unauthorized messaging to deliverables, and violate user expectations or downstream trust requirements.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The builder unconditionally appends an extra disclaimer/branding slide to every deck, altering output semantics and length without user consent. This is a supply-chain style integrity issue: a low-level rendering component should not silently add content that may affect business, legal, or client-facing materials.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The disclaimer page includes branded feedback and business-contact channels unrelated to PPT construction, which turns the adapter into a content-injecting promotional component. In sensitive workflows, such inserted contact data could create confidentiality, reputational, or policy-compliance issues if presentations are shared externally.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: This file implements a full decision-support pipeline that performs routing, framework-specific analysis, recommendation generation, and audit packaging, which is materially unrelated to an article-to-PPT conversion skill. In a skill that should only transform content locally, hidden business-analysis logic expands the attack surface, creates undeclared capability, and can enable unauthorized processing of sensitive user inputs under misleading expectations.

Context-Inappropriate Capability

High

• Confidence: 92% confidence
• Finding: The framework routing and recommendation logic dynamically selects analytical frameworks and produces recommendations, which is unrelated to HTML-to-PPT rendering. In the context of a presentation-conversion skill, this constitutes unjustified latent functionality that could process user-provided content or metadata for secondary purposes, undermining trust and increasing the risk of misuse or hidden data handling.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The audit explicitly states the bundle contains 'public PMO production-runtime source assets' under `private-pmo-pack/` and that it must not be uploaded to a public registry or repository. For a skill described as article-to-PPT conversion, inclusion of unrelated private runtime assets expands the attack surface and creates a real risk of unintended disclosure of proprietary internal code or data-bearing components if the package is distributed beyond its intended private boundary.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The PMO trigger rules are broad enough that ordinary project-management wording can automatically switch execution into a specialized builder path. In an agent context, broad semantic triggers are risky because an attacker or even a benign document can steer tool selection and subprocess execution without an explicit, narrow authorization decision.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The skill explicitly instructs the agent to generate and then execute a standalone Python script without confirmation when Path A is selected. Automatic execution of freshly generated code is a high-risk pattern because prompt-influenced content can shape the script, leading to arbitrary local command execution, file modification, data exposure, or lateral actions under the agent's runtime privileges.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/BUNDLE-AUDIT.json:472

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/BUNDLE-AUDIT.md:73