T08 · Insecure Dependencies
Warning
- Location
SKILL.md:136- Finding
Unpinned Installation of the Unused requests Package
- Content
View full analysis
- Remediation
View remediation
Security audit
演示文稿生成（免费版）
Security checks for vulnerabilities and agentic risk
Overview
This presentation-generation skill is mostly coherent, but it asks for broad execution/write authority and includes under-scoped delete, callback, and package-install behavior that users should review before installing.
Install only if you are comfortable granting the agent command execution and file-write access for presentation generation. Use a sandbox or virtual environment, pin dependencies, choose explicit output paths, avoid callback_url unless you trust the destination, and require confirmation before any modify/delete or overwrite action.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:218- Finding
Unpinned Installation of the Required python-pptx Package
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill advertises creation/query/export behavior and has exec capability, but it does not warn users that execution and file operations may affect the local system. In practice this can lead users or downstream agents to permit code execution and filesystem writes without understanding the associated risks.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill is described as a presentation-generation tool, but the documentation expands its capabilities to generic create/query/modify/delete operations. This widens the implied authority of the skill beyond its stated purpose and can normalize destructive actions under vague runtime parameters, increasing the chance of unintended file or content modification.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The invocation examples use broad natural-language phrases like generating or converting documents without defining clear trigger boundaries, confirmation rules, or operational constraints. In an agent environment with read/write/exec tools, ambiguous activation can cause the skill to act on nearby files or user content unexpectedly.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The callback_url parameter introduces outbound network interaction that is not necessary for a local PPT-generation workflow. If honored by an agent, it could be abused for data exfiltration, SSRF-style requests, or sending generated content and metadata to attacker-controlled endpoints.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The display name, summary, description, and operational guidance are written in Chinese, and the file does not indicate that the skill is region-specific or provide an alternative language option. This can violate language/locale policy when a skill implicitly forces a specific language without user opt-in.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The sample code saves output.pptx directly without warning about file creation or overwrite behavior. While the example is simple, copying it into an automated agent workflow could overwrite an existing file or create artifacts in unintended locations.
- Content
Static analysis
No suspicious patterns detected.