Security audit

PPTX PDF字体修复工具

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a PPTX font repair helper, but its instructions broaden into API keys, external service calls, generic file processing, and command execution without clear need or boundaries.

Review this skill before installing. It may be useful for PPTX repair, but only run it on files you are prepared to modify, avoid providing API keys unless you understand which service is used and what data is sent, and require explicit approval before any command execution or network/API use.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The skill is presented as a narrow local PPTX font-repair utility, but its documented capabilities expand to external API integration and system command execution. This mismatch increases the risk of over-privileged use, surprising data egress, or unintended code execution because users may grant trust based on the narrower stated purpose.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The skill claims to be local-only, yet instructs users to configure API keys and establish API connections. This contradiction is dangerous because users may unknowingly expose document contents or credentials to remote services under the false assumption that processing is strictly local.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: External API access is not justified by the stated purpose of a narrow local PPTX font-repair tool. Unnecessary network access expands the attack surface and can enable covert exfiltration of uploaded documents, metadata, or environment secrets such as API keys.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: System command execution is excessive for a skill marketed as a narrow document-repair utility. If implemented loosely, this capability can be abused to run arbitrary shell commands, access local files, or pivot to broader host compromise, especially when users supply file paths or parameters.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: Overly broad activation guidance makes a supposedly narrow skill applicable to many generic file-processing and conversion tasks. This scope creep can cause the agent to invoke a more privileged skill than necessary, increasing the chance of unsafe file writes, command use, or unintended external calls.

Missing User Warnings

Medium

Confidence: 80% confidence
Finding: The description does not clearly warn users that the skill edits and writes changes to user-provided PPTX files locally. Without explicit notice, users may unintentionally allow destructive modification or overwrite important documents without adequate backup or review.

Static analysis

No suspicious patterns detected.