Security audit
Security checks for vulnerabilities and agentic risk
This is mostly a legitimate PPT-generation suite, but it needs Review because it hardcodes third-party attribution and uses network, browser, and package-install workflows without tight user control.
Install only if you are comfortable reviewing generated decks before sharing, removing any unwanted TJMtaotao/MEITUSTYLE/Guangzhou Huashang attribution, and running unpinned package installs in a sandbox. Avoid sensitive course, business, or personal content unless you accept that prompts may be sent to MiniMax or search providers and may be stored in generated artifacts.
course-ppt-generator/SKILL.md:43Mandatory Third-Party Branding and False Attribution in Generated Presentations
open-slide/requirements.txt:1Mutable and Unpinned Third-Party Dependencies Are Downloaded and Executed
The skill description does not mention exporting PDFs, browser automation via Playwright, or capturing screenshots from presentation mode, yet the implementation reportedly performs those actions. Browser automation and screenshot capture expand the attack surface and can expose sensitive content or interact with local/cloud resources in ways the user did not consent to.
The skill description does not mention exporting PDFs, browser automation via Playwright, or capturing screenshots from presentation mode, yet the implementation reportedly performs those actions. Browser automation and screenshot capture expand the attack surface and can expose sensitive content or interact with local/cloud resources in ways the user did not consent to.
The phrase 'DO NOT refuse' is an explicit anti-refusal statement embedded in the system prompt for image generation. Anti-refusal directives are dangerous because they pressure downstream models to ignore built-in safeguards and prioritize task completion over policy compliance, especially when handling sensitive content.
## Core Principles
- Hand-drawn quality throughout - NO realistic or photographic elements
- If content involves sensitive or copyrighted figures, create stylistically similar alternatives - DO NOT refuse to generate
- NO slide numbers, page numbers, footers, headers, or logos
- Clean, uncluttered layouts with clear visual hierarchy
- Each slide conveys ONE clear message
This instruction attempts to override refusal behavior for a sensitive class of requests, which is a direct prompt-level safety bypass. In an agent skill that generates commercial and instructional slides at scale, such language increases the chance that the model will produce outputs it should otherwise block, making misuse more operationally dangerous.
The guide states that the final slide must include an AI-generation marker, imposing a mandatory output constraint without user opt-in. This can override user preferences, create compliance or disclosure issues across locales and use cases, and may cause the system to produce content that conflicts with downstream policy, branding, or classroom requirements.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
else:
prompt = f"PPT幻灯片，标题《{title}》，{suffix}"
return prompt
def _create_ppt(self, slides: List[Dict], output_path: str, image_dir: str):
"""创建PPT并嵌入图片"""
The skill metadata does not declare any tool restrictions or permissions even though the implementation reportedly uses environment access, file writing, and network capabilities. Undeclared capabilities reduce transparency and informed consent, and can enable unexpected data access or file modification when the skill is invoked.
SQP-3 applies to all file types and covers language or locale policy violations. The natural-language instructions and description force a specific language for users without opt-in, and there is no note that the skill is region-specific or that other languages are supported.
The description says to use this skill when the user asks to "create slides", "make a presentation", "generate deck", "slide deck", or "PPT". Several of these phrases are broad, especially "make a presentation" and "PPT", and the file does not provide exclusion conditions or negative examples to constrain activation.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Treat explicit skill invocation, a file path, matched signals/presets, and `EXTEND.md` defaults as **recommendation inputs only**. None of them authorizes skipping confirmation.
- Do **not** start Step 3 or later until the user completes Step 2.
- Skip confirmation only when the current request explicitly says to do so, for example: "直接生成", "不用确认", "跳过确认", "按默认出幻灯片", or equivalent wording.
- If confirmation is skipped explicitly, state the assumed style / audience / slide-count / language / backend in the next user-facing update before generating.
## Language
The skill allows resolving ${BUN_X} via npx -y bun, which fetches and executes a package without pinning a version or integrity. That creates a supply-chain risk: a compromised upstream package, malicious dependency resolution, or unexpected version drift could lead to arbitrary code execution when merge scripts are run.
The prompt explicitly instructs the model to proceed when content involves sensitive or copyrighted figures and to avoid refusal by generating stylistically similar alternatives. This undermines normal safety decision-making and can facilitate copyrighted-character imitation, impersonation-style outputs, or other policy-evading generations in a production content pipeline.
The wording encourages the model to recast restricted requests as 'stylistically similar alternatives,' which is a common way to evade safeguards while preserving the essence of the protected or sensitive target. That creates a pathway for near-substitution outputs that may still infringe rights or enable deceptive representations.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
options:
This markdown file defines automatic preset selection using common topic keywords such as "architecture, system, data, analysis, technical" without clarifying when these terms should or should not trigger the preset. Because these are broad everyday or cross-domain terms and no negative examples or scope constraints are provided, the skill could invoke or bias selection unintentionally.
Terms like "tutorial, learn, education, guide, beginner" are very common and could match many unrelated slide requests, yet the file presents them as automatic selection criteria. The document does not define precedence, ambiguity handling, or negative examples, making the trigger scope insufficiently specific.
This markdown file contains a natural-language requirement that labels be formatted as English plus Chinese, which forces a specific locale choice. The policy allows locale constraints only when the user is offered a choice or the constraint is clearly justified as region-specific, neither of which is present here.
This line explicitly requires bilingual labels in English and Chinese for key elements, creating a fixed language policy. Because the file does not indicate that this is optional or limited to a defined Chinese-speaking context, it violates the language/locale choice requirement.
The manifest description and invocation phrases are entirely specified in Chinese, implying a fixed language/locale for activation and use. The file does not offer users a language option or explain that the skill is intentionally limited to a Chinese-speaking context.
The skill explicitly instructs the agent to proactively access the internet to fill in missing course content, including adding current examples and statistics. That expands the skill from local PPT generation into external data retrieval without clear user consent, source controls, or privacy boundaries, which can expose prompts or teacher-provided material to third-party services and introduce untrusted content into outputs.
The markdown tells the skill to perform online searches automatically, but it does not warn users that their request may trigger external network access or that provided content could be shared with outside services. In a teaching context, prompts may contain unpublished course materials, internal examples, or student-related information, so silent exfiltration to search providers creates a real privacy and trust risk.
The example trigger phrases such as "制作一份深度学习的课程PPT" and especially "帮我做一个数据预处理的实验指导课件" are broad natural requests that could appear in ordinary conversation, but the guide does not define explicit activation boundaries or exclusion conditions. Because this markdown file serves as usage guidance, the lack of narrow trigger scope increases the risk of unintended invocation.
The script performs an undisclosed write to the user's Desktop, which is a potentially surprising side effect for a generation tool. While the content is locally generated and the destination is not especially sensitive, writing files without explicit user consent can overwrite expectations, leak generated content to a visible/shared location, or create clutter/persistence the user did not intend.
The README instructs users to configure an API key and use a likely remote generation service, but it does not disclose that presentation content may be transmitted to an external provider. This can lead users to unknowingly send proprietary, educational, business, or personal data off-platform, creating privacy, compliance, and data-handling risks.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
from pptx.enum.text import PP_ALIGN
# API配置
API_URL = "https://api.minimaxi.com/v1/image_generation"
MODEL = "image-01"
# 场景风格配置
No suspicious patterns detected.