PPT字体修复工具（免费版）

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:28 AM UTC
• Version: 1.0.2

Overview

This skill is a simple Markdown-only PPT font repair guide with expected document-processing permissions, but users should control file writes and dependency installs carefully.

Install only if you are comfortable with the agent reading and writing PPT/PDF files and possibly running local conversion tools. Specify exact input files and output directories, keep backups before repair or conversion, and prefer installing pinned dependencies in an isolated virtual environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:142

Finding

Unpinned Third-Party Python Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:142 and SKILL.md:232
Vulnerability Type: Unpinned dependency installation
Risk Level: Medium

Vulnerable Code

At SKILL.md:138-143:

bash

# Ensure the Python environment is available
python3 --version
# ...
# Dependencies
pip install requests

At SKILL.md:228-233:

markdown

| Dependency | Type | Required | Installation Method |
|---:|---:|---:|---:|
| LLM API | API | Required | Provided by the Agent's built-in LLM |
| python-pptx | Python package | Required | pip install python-pptx |
| libreoffice | System tool | Optional | LibreOffice is required for PDF conversion |

Technical Analysis

The skill instructs the Agent to install requests and python-pptx without version constraints or cryptographic hashes. Consequently, the installed artifacts depend on the package versions served by the configured Python package index at execution time rather than on dependencies verified during the skill audit.

If a package release, package-index account, configured mirror, or dependency in the transitive dependency graph is compromised, invoking these commands could install attacker-controlled code. Python packages may execute code during installation or when imported later by the skill.

The provided example does not import or otherwise use requests, so its installation unnecessarily expands the supply-chain attack surface.

Attack Path

1. An attacker compromises a relevant package release, publisher account, package mirror, or transitive dependency.
2. A user or Agent follows the skill instructions and runs pip install requests or pip install python-pptx.
3. Pip resolves the current package version from the configured index without checking a project-supplied version lock or hash.
4. The malicious package code executes during installation or when the installed module is imported.
5. The code operates with the ...[truncated 812 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the requests installation instruction unless the skill implements functionality that requires it.
2. Pin every required package to a reviewed version, for example python-pptx==<reviewed-version>.
3. Maintain dependencies in a lock file or requirements file generated from a reviewed environment.
4. Require package hashes using a command such as pip install --require-hashes -r requirements.txt.
5. Pin and review transitive dependencies rather than relying only on top-level version constraints.
6. Install packages from an explicitly approved index or internal mirror.
7. Perform dependency installation in an isolated virtual environment or restricted container without unnecessary credentials or filesystem access.
8. Add automated vulnerability and integrity scanning for dependency updates before changing pinned versions.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill advertises broad natural-language invocation phrases such as repairing fonts or converting PPT to PDF without clear activation boundaries, confirmation requirements, or scoped inputs. In an agent environment with read/exec/write tools, ambiguous triggers can cause the skill to activate on loosely related user requests and perform file-processing or command-execution steps the user did not explicitly authorize.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill declares MD+EXEC capability and includes dependencies like LibreOffice and file-processing libraries, but it does not clearly warn users that operations may execute local commands and modify files. This lack of disclosure increases the risk of unsafe use because users may invoke the skill expecting passive analysis while the agent can actually transform documents, create outputs, or run system tools.

Content

No source excerpt is available for this finding.