ClawHub
Back to skill

Security audit

Markdown To Slides

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Markdown-to-PPTX converter with some ordinary file-writing and dependency hygiene caveats.

Before installing, expect this skill to read the Markdown file you select, create a temporary schema JSON, and write a PPTX output file. Use explicit input and output paths, avoid running it in sensitive directories if temporary files matter, and prefer a reviewed install with pinned dependencies or a lockfile for reproducibility.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (17)

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md
node scripts/generate-pptx.cjs <schema.json路径> <输出路径>

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The trigger set is broad enough to match ordinary requests about creating presentations, which can cause the skill to activate unexpectedly and gain access to local files or execute its workflow without clear user intent. In this skill, activation leads to reading user-specified files, writing temporary schema files, and invoking a local script, so overbroad routing expands the chance of unintended file operations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The entire skill file is written as a Chinese-only prompt template, including system instructions and output requirements, with no indication that users can choose another language or that the skill is limited to a Chinese-specific context. This creates a natural-language locale policy issue because the skill appears to enforce a specific language by default rather than offering opt-in or documenting a justified regional constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill instructs writing a temporary PresentationSchema JSON into the current working directory without an explicit user-facing warning or path-safety guidance. This can lead to unintended file creation in sensitive project directories, accidental overwrites, or leakage of document contents into repos or synced folders if the user is unaware of where artifacts are being stored.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
96% confidence
Finding

The dependency uses a caret range instead of an exact pinned version, which allows different installs over time to resolve to different package releases. This increases supply-chain risk and makes builds less reproducible, especially for an agent skill that generates files from user content and may be run in varied environments.

Content

Scanner excerpt · package.json (reported line 10)May include surrounding context.

json
"generate": "node generate-pptx.cjs"
  },
  "dependencies": {
    "pptxgenjs": "^4.0.1",
    "react": "^18.3.1",
    "react-dom": "^18.3.1",
    "react-icons": "^5.6.0",

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
96% confidence
Finding

The react dependency is not pinned to an exact version, so future installs may pull different compatible releases than originally tested. This creates reproducibility and supply-chain integrity issues, even if it does not by itself prove a directly exploitable flaw in this file.

Content

Scanner excerpt · package.json (reported line 11)May include surrounding context.

json
},
  "dependencies": {
    "pptxgenjs": "^4.0.1",
    "react": "^18.3.1",
    "react-dom": "^18.3.1",
    "react-icons": "^5.6.0",
    "sharp": "^0.34.5"

Unverifiable Dependency: react has 2 known advisory(ies) (CVE-2013-7035 (Cross-Site Scripting in react); GHSA-hg79-j56m-fxgv (Cross-Site Scripting in react)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
96% confidence
Finding

The react-dom dependency is specified with a floating semver range, allowing installation drift across environments. In security terms this weakens dependency integrity guarantees and can expose consumers to newly introduced vulnerable transitive versions.

Content

Scanner excerpt · package.json (reported line 12)May include surrounding context.

json
"dependencies": {
    "pptxgenjs": "^4.0.1",
    "react": "^18.3.1",
    "react-dom": "^18.3.1",
    "react-icons": "^5.6.0",
    "sharp": "^0.34.5"
  }

Unverifiable Dependency: react-dom has 1 known advisory(ies) (CVE-2018-6341 (Cross-Site Scripting in react-dom)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The react-icons package is unpinned, which permits unreviewed minor and patch updates to be installed. While lower risk than direct code injection in this file, it still represents a real supply-chain exposure and hampers reproducible builds.

Content

Scanner excerpt · package.json (reported line 13)May include surrounding context.

json
"pptxgenjs": "^4.0.1",
    "react": "^18.3.1",
    "react-dom": "^18.3.1",
    "react-icons": "^5.6.0",
    "sharp": "^0.34.5"
  }
}

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The sharp dependency is not pinned to an exact version, which is more concerning because native/image-processing libraries have historically had security issues in bundled components. Since this skill converts markdown to PPTX and may process embedded images, dependency drift in sharp could materially increase exposure to parsing-related vulnerabilities.

Content

Scanner excerpt · package.json (reported line 14)May include surrounding context.

json
"react": "^18.3.1",
    "react-dom": "^18.3.1",
    "react-icons": "^5.6.0",
    "sharp": "^0.34.5"
  }
}

Unverifiable Dependency: sharp has 4 known advisory(ies) (GHSA-54xq-cgqr-rpm3 (sharp vulnerability in libwebp dependency CVE-2023-4863); GHSA-f88m-g3jw-g9cj (sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-); CVE-2022-29256 (sharp vulnerable to Command Injection in post-installation over build environmen) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document title and descriptive text are entirely in Chinese, and the schema field comments throughout the file continue this language-specific presentation without any indication that another language is supported. Under the stated policy, forcing a specific language without user opt-in or a documented regional justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.