T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:187- Finding
Sensitive Environment Variables May Be Exposed During Configuration Validation
- Content
View full analysis
- Remediation
View remediation
Security audit
PPT 工具 v1.0 基础版
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a PowerPoint automation guide, but it gives agents broad execution/API latitude while making inconsistent privacy and credential-handling claims.
Review before installing. Use it only on presentation files you intend the agent to access, avoid running the broad environment-variable check, and do not rely on the 'all data stays local' claim unless network/API/callback behavior is disabled or clarified.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill claims that all data remains local and is not uploaded to the cloud, yet elsewhere it explicitly supports external APIs and callback URLs. This creates a misleading security guarantee that may cause users to provide sensitive presentation content or credentials under false assumptions, increasing the chance of unintended data disclosure to third parties.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The natural-language invocation guidance is vague and says the agent will automatically execute the corresponding operation based on user description, without scope boundaries. In a skill that has exec and file-system tooling, ambiguous invocation increases the risk of the agent taking higher-impact actions than the user expected or routing sensitive requests into this skill unnecessarily.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger conditions are broad and mismatched to the PowerPoint-focused scope, instructing use for data analysis, reporting, and visualization. In an agent setting, overly broad routing guidance can cause the skill to activate on unrelated tasks and then use powerful tools such as exec, grep, or external APIs in contexts the user did not intend.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
L158 says the skill should be used for data analysis, report generation, statistical insights, and data visualization. That contradicts the surrounding PPT-focused documentation and the stated FREE-version limitations at L90, L99-L106, and L280-L284, which say advanced data analysis belongs to PRO or is unsupported. This is not merely incomplete wording; it directs use toward a different capability set than the rest of the file describes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill states that the agent will automatically call tools or APIs and execute operations, but does not prominently warn users about command execution, file access, or outbound network activity. Because the declared toolset includes exec, read, glob, and grep, this omission can lead to silent execution of local commands or external transmissions without informed consent.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
All user-facing instructions, examples, and operational guidance are presented in Chinese, with no indication that users may choose another language. This can be a language/locale policy issue when the skill is not documented as region-specific or explicitly opt-in for Chinese-only operation.
- Content