ClawHub
Back to skill

Security audit

present-ppt

Security checks for vulnerabilities and agentic risk

Overview

This is a local HTML-to-PPTX conversion skill with expected file output and no evidence of credential access, persistence, exfiltration, or destructive behavior.

Install only if you are comfortable with a Node/npm local converter that reads your input HTML and writes PPTX/model/QA files. Review generated decks, especially the data-strategy-deck preset, because some template slides can substitute fixed wording instead of preserving every source title or label. Keep npm dependencies updated through a reviewed lockfile process.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The declared description centers on HTML-to-PPTX conversion and preset extension for slide generation. The supplied code instead performs preflight quality assurance on already-structured JSON models for a few named presets ('v9-architecture', 'ai-runtime-page', 'data-strategy-deck'). It estimates whether text blocks fit within predefined layout boxes, checks spacing constraints, summarizes issues, and emits a JSON report. While this may support a broader slide-generation workflow, the chunk itself does not implement the declared conversion behavior and has a materially different primary purpose.

Ae1

High
Category
analysis-evasion
Content
node scripts/preflight_qa.js <model.json> [--preset=v9-architecture|ai-runtime-page] [--report <report.json>]
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Known Vulnerable Dependency: image-size==1.2.1 — 2 advisory(ies): CVE-2025-71329 (image-size: JXL and HEIF parsers allow denial of service through infinite loops); CVE-2025-71330 (image-size: ICNS parser allows denial of service through an infinite loop)

High
Category
Supply Chain
Confidence
97% confidence
Finding
The lockfile pins image-size to 1.2.1, and the reported advisories describe infinite-loop denial-of-service flaws in multiple image parsers. Because this skill generates PPTX files and depends on pptxgenjs, which in turn may inspect attacker-supplied image assets, malformed images could cause the conversion process to hang or exhaust worker time. The skill context makes this more relevant because presentation conversion commonly handles untrusted images embedded in HTML or referenced assets.

Known Vulnerable Dependency: undici==7.24.7 — 12 advisory(ies): CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-13697 (undici vulnerable to cross-user information disclosure and parse-time crash via ); CVE-2026-16728 (undici vulnerable to downstream response desynchronization via retry interceptor) +9 more

High
Category
Supply Chain
Confidence
86% confidence
Finding
The lockfile includes undici 7.24.7, which is flagged for multiple HTTP client issues including response queue poisoning, desynchronization, information disclosure, and parser crashes. In this skill, cheerio brings in undici and HTML-to-PPT conversion workflows may fetch remote HTML or assets, so a malicious upstream server or attacker-controlled URL could potentially trigger incorrect response handling, crashes, or data leakage across requests. The context increases concern if the skill accepts arbitrary URLs or retrieves external resources during conversion.

Natural-Language Policy Violations

Medium
Confidence
88% confidence
Finding
文件名 `README_CN.md` 明确表明该说明文档为中文版本，但文档中没有说明是否提供其他语言版本、用户是否可以选择语言，或该语言限制是否出于特定区域/合规原因。根据规则，强制特定语言而无用户选择或合理说明，属于自然语言层面的语言/地区政策风险。

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The title slide renderer ignores the parsed title and replaces it with hard-coded text. Because this skill's purpose is document conversion, silently overriding the user's supplied title undermines output integrity and could be abused to misbrand or falsify the generated presentation.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The architecture renderer discards parsed HTML content and substitutes hard-coded slide structure and text. In a conversion skill that is expected to faithfully transform user-provided HTML into editable PPTX content, this creates an integrity problem: user input can be silently replaced with different messaging, leading to misleading or manipulated output without the user's awareness.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The closing slide renderer ignores the parsed HTML title and emits fixed messaging instead. In this skill context, where users expect high-fidelity editable conversion, replacing supplied closing content with preset slogans can materially alter the meaning of a deck and produce deceptive business artifacts.

Natural-Language Policy Violations

Medium
Confidence
92% confidence
Finding
This JavaScript file sets `FONT_CN = 'PingFang SC'` and uses it as the default `fontFace` for added text, which imposes a specific locale/language-oriented presentation choice. Under the policy, forcing a language/locale without user opt-in or justification is a natural-language policy concern.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"private": true,
  "type": "commonjs",
  "dependencies": {
    "cheerio": "^1.2.0",
    "pptxgenjs": "^4.0.1"
  }
}
Confidence
89% confidence
Finding
The dependency uses a caret range, which allows npm to install newer compatible releases without explicit review. This creates supply-chain risk because a compromised or breaking upstream release could be pulled into future installs, though the package.json alone does not indicate active exploitation.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"type": "commonjs",
  "dependencies": {
    "cheerio": "^1.2.0",
    "pptxgenjs": "^4.0.1"
  }
}
Confidence
89% confidence
Finding
The dependency is not pinned to an exact version, so future installs may resolve to different upstream releases. In a build tool that converts HTML to PPTX, this increases exposure to supply-chain compromise or unexpected behavior if a dependency update introduces malicious code or unsafe parsing behavior.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/html_to_pptx.js:60