ClawHub
Back to skill

Security audit

演示文稿生成（免费版）

Security checks across malware telemetry and agentic risk

Overview

This skill is a presentation-generation helper that may create local PPTX files, and its requested read/write/exec access generally matches that purpose.

Install this if you want an agent to generate PowerPoint files locally. Use a clear output path, avoid feeding sensitive documents unless you trust the agent environment, and check before allowing package installation or overwriting existing PPTX files.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The skill uses broad trigger examples such as generating a PPT from a topic or report, which overlap heavily with normal user requests and can cause the agent to invoke this skill unexpectedly. Because the skill has read/exec/write capabilities and produces files on disk, accidental activation can lead to unintended file creation or execution flow without sufficiently explicit user consent.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The documentation demonstrates saving output.pptx to disk but does not clearly warn users that the skill writes files locally. In an agent environment with write permissions, this can surprise users, overwrite existing files, or leave sensitive presentation artifacts on disk without informed consent.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.