ppt-icon-generator

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 3:59 AM UTC
• Version: 1.0.0

Overview

This skill appears to be a normal PowerPoint icon helper, with some documentation gaps around external services and output behavior but no evidence of hidden, destructive, or credential-seeking activity.

Install only if you are comfortable with icon searches and some prompt text being sent to external services such as Iconify, SimpleSVG, or Copilot when those workflows are used. Treat the prompt-based generator as a simple local fallback unless you manually use an external AI tool, and verify outputs because PNG generation can fall back to SVG when conversion dependencies are missing.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: Presenting the skill as a full icon generation/search tool while the analyzed behavior appears focused on verification or limited local processing creates an integrity problem. Security-wise, misleading operators about what code does can hide actual data flows and produce unsafe automation decisions based on inaccurate documentation.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: Presenting the skill as a full icon generation/search tool while the analyzed behavior appears focused on verification or limited local processing creates an integrity problem. Security-wise, misleading operators about what code does can hide actual data flows and produce unsafe automation decisions based on inaccurate documentation.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: Presenting the skill as a full icon generation/search tool while the analyzed behavior appears focused on verification or limited local processing creates an integrity problem. Security-wise, misleading operators about what code does can hide actual data flows and produce unsafe automation decisions based on inaccurate documentation.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation encourages icon search and AI-assisted generation using external services but does not warn that prompts, search terms, or possibly user-provided content will be transmitted off-host. This creates a privacy and data-handling risk, especially if users include confidential slide content, project names, or proprietary concepts in prompts.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Links & Resources

- Iconify API: https://api.iconify.design/
- Icon Sets: Material Design, Fluent, Heroicons, Phosphor
- Color Picker: https://colorpicker.me/

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

'--export-width', str(size),
            '--export-height', str(size)
        ]
        subprocess.run(cmd, check=True, capture_output=True)
        print(f"✅ Converted: {png_path}")
        return True
    except (subprocess.CalledProcessError, FileNotFoundError):

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The argument help at L302 describes the prompt as being 'for AI generation', which implies the prompt will drive icon generation. In reality, when --prompt is used, the code merely prints the prompt, states that external API support is required, and falls back to generating a generic circle icon, so the documented intent contradicts actual behavior.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest describes generating or searching transparent PNG icons, and this function is specifically named and documented as downloading a PNG. However, when CairoSVG is unavailable, the code silently falls back to writing an SVG file and still returns success, which means the actual behavior can differ materially from the stated PNG output promise.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The docstring for `download_icon_png` states "Download icon as PNG", but the ImportError fallback writes an `.svg` file and returns success. That is an active contradiction between the function's stated intent and what the code may actually do at runtime.

External Transmission

Medium

• Category: Data Exfiltration

Content

# Try different endpoints
        urls = [
            f"{ICONIFY_API}/{prefix}/{name}.svg",
            f"https://api.simplesvg.com/{prefix}/{name}.svg"
        ]
        
        svg_content = None

• Confidence: 73% confidence
• Finding: The script transmits icon identifiers to an additional third-party endpoint, api.simplesvg.com, when fetching SVG content. Even though the data is not highly sensitive by itself, contacting an unexpected external service expands data exposure, trust, and supply-chain risk, especially because downloaded SVG content is then processed by a renderer library.

Static analysis

No suspicious patterns detected.