ClawHub
Back to skill

Security audit

PPT Generator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent presentation generator, with the main caution that generated HTML loads third-party CDN resources.

Install only if you are comfortable with a Chinese-oriented slide generator and with generated presentations contacting third-party CDNs when opened. For sensitive or offline presentations, replace the CDN script and fonts with bundled or locally hosted resources before sharing the HTML.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning
Location
assets/template.html:7
Finding

Unverified Third-Party JavaScript Executes in Generated Presentations

Content
View full analysis

Vulnerability Details

File Location: assets/template.html, lines 7–8
Vulnerability Type: Remote executable dependency without integrity verification
Risk Level: Medium

Vulnerable Code

html
<!-- TailwindCSS CDN -->
<script src="https://lf26-cdn-tos.bytecdntp.com/cdn/expire-1-M/tailwindcss/3.0.23/tailwind.min.js"></script>

Technical Analysis

The presentation template loads and executes JavaScript from lf26-cdn-tos.bytecdntp.com whenever a generated presentation is opened with network connectivity. The external script is not protected by a Subresource Integrity hash, and the document does not define a restrictive Content Security Policy.

Although the URL contains a version-like path, the remote response remains outside the audited package and can change after review. Compromise of the CDN, its hosting account, DNS resolution, or the hosted asset could therefore replace the expected dependency with attacker-controlled JavaScript.

The script executes in the generated presentation's browser context. This is primarily a remote payload retrieval risk and secondarily a dependency supply-chain weakness. It also means the advertised single-file output is not fully self-contained.

Attack Path

  1. The skill generates a presentation using assets/template.html.
  2. The victim opens the resulting HTML file while connected to the network.
  3. The browser requests tailwind.min.js from the third-party CDN.
  4. An attacker who has compromised the CDN, hosted asset, CDN account, or relevant network resolution path substitutes a malicious response.
  5. Because no integrity hash validates the response, the browser accepts and executes the substituted JavaScript.
  6. The malicious script can inspect or alter the presentation DOM, monitor interactions, and issue outbound requests permitted by the browser.

Impact Assessment

Successful exploitation provides JavaScript execution within the generated presentation's origin and browser contex ...[truncated 528 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the runtime JavaScript dependency and compile the required Tailwind utility styles into static CSS.
  2. Embed the resulting CSS directly in the generated HTML so the presentation is genuinely self-contained.
  3. If remote loading is unavoidable:
    • Use a trusted official distribution.
    • Pin an immutable artifact.
    • Add a verified Subresource Integrity hash.
    • Set crossorigin="anonymous" as required for SRI validation.
  4. Add a restrictive Content Security Policy that permits scripts only from explicitly approved sources and limits outbound connections.
  5. Bundle fonts locally where licensing permits to reduce additional third-party trust and improve offline reliability.
  6. Test generated presentations without network access to verify that all essential styling and functionality remain available.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md
使用 [assets/template.html](assets/template.html) 作为基础模板生成完整HTML。

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger description is broad enough to activate on many generic presentation-related requests, not just the narrowly intended 'Jobs-style vertical HTML deck' use case. Over-broad routing can cause the wrong skill to take control of benign user tasks, leading to inappropriate transformations, policy drift, or unexpected HTML generation when the user did not specifically ask for this format.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill description hardcodes Chinese-language output expectations without checking or preserving the user's language preference. This can cause incorrect or unexpected output routing, reduce usability, and in some systems may override higher-level user intent or localization controls.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill metadata and default prompt require Chinese-language interaction/output without indicating that this is optional or justified by the skill's operating constraints. This can cause mismatches with user intent, reduce transparency, and produce unexpected behavior for non-Chinese users, especially if the platform assumes locale-neutral skill behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The default prompt '请根据我的讲稿生成科技风PPT' is broadly phrased and can match a wide range of normal user requests, making the skill likely to activate in situations beyond its intended scope. Over-broad triggering can cause unintended routing, reduce user control, and lead to the skill handling content or tasks that should have remained with the base assistant or a more appropriate skill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The template is advertised as a single directly runnable HTML file, but it depends on third-party CDN-hosted JavaScript and fonts. This creates a supply-chain and availability risk: remote resources can change, be blocked, or be compromised, causing the generated presentation to execute untrusted code or fail offline.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

A local PPT HTML generator has no clear need to fetch code and fonts from third-party CDNs at runtime. This expands the attack surface by leaking user access metadata to external providers and exposing presentations to supply-chain compromise or network-based failure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document root sets lang="zh-CN", and the visible UI text throughout the template is also fixed in Chinese. Under the policy rules, forcing a specific language or locale without user opt-in is a natural-language policy concern unless the constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The design spec requires loading fonts from third-party CDNs, which introduces unnecessary external network dependencies into a skill whose stated output is a single self-contained HTML presentation. This can leak viewer metadata such as IP address and user agent to external providers, reduce offline portability, and create supply-chain/privacy risk if the CDN content changes or is unavailable.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The section titled '字体加载（国内CDN）' specifies Chinese font resources such as HarmonyOS Sans SC and Noto Sans SC, indicating a Chinese-locale design requirement. Because the document does not offer any language or locale alternative or explain a justified region-specific constraint, it can be read as forcing a specific locale without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file uses only Chinese for its headings, instructions, and examples, which can amount to a language policy constraint if users are not given an option to choose another language. The file does not state that it is region-specific or provide any opt-in or alternative language guidance.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.