ClawHub
Back to skill

Security audit

PPT Generator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent local PPTX generator, with only documentation accuracy and dependency hygiene issues to consider.

Install this only if you are comfortable running a local Python PPTX generator and installing python-pptx from pip. Prefer using a virtual environment and a pinned dependency version, and review any JSON image paths because the script will read local image files you reference and write the requested output file.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Note
Location
SKILL.md:8
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:8
Vulnerability Type: Unpinned dependency and non-reproducible package resolution
Risk Level: Low

Vulnerable Code:

yaml
dependencies: "pip install python-pptx"

Technical Analysis

The installation instruction retrieves python-pptx without specifying an exact reviewed version or verifying an integrity hash. Consequently, the package resolved during installation may change over time without any corresponding modification to this project.

The package name matches the library imported by the implementation, and no suspicious package index or alternate source is specified. Nevertheless, reliance on the latest available release creates supply-chain exposure. If the package distribution channel or a future release is compromised, malicious code could run during package installation or when the dependency is imported by scripts/generate_pptx.py.

Attack Path

  1. An attacker compromises the dependency's publication account, distribution channel, or a future package release.
  2. A user installs the Skill's dependency using the documented unpinned command.
  3. Package resolution selects the compromised release because no exact version or hash is enforced.
  4. Malicious code executes during installation or when Python imports the dependency.
  5. The payload operates with the permissions of the user or service account running the installation or presentation generator.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the installing or executing user's privileges. The resulting scope could include access to files, environment variables, credentials, and network resources available to that account. It could also compromise generated documents or modify user-owned files. This issue does not directly grant elevated system privileges; its effective authority is limited to the privileges and environment of the affected ...[truncated 8 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin python-pptx to an exact version that has been reviewed and tested, for example:
    text
    python-pptx==<reviewed-version>
  2. Move dependency declarations into a version-controlled requirements or lock file.
  3. Record SHA-256 hashes for the package and all transitive dependencies.
  4. Enforce hash verification during installation:
    bash
    python3 -m pip install --require-hashes -r requirements.txt
  5. Use a trusted, explicitly configured package index and review dependency updates before changing the lock file.
  6. Run installation and document generation under a least-privileged account or isolated environment to reduce the impact of a compromised dependency.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

整体上，代码的主功能与声明高度一致：它确实用于生成可编辑 PPTX，采用 JSON 驱动，并支持表格、图表、时间线和图片，也有 5 套配色方案，没有发现与声明无关的敏感行为（如网络访问、数据外传、系统控制等）。不过，声明中的关键能力数量与实际实现不准确：声明称有 11 种幻灯片类型，而代码中 build_from_json 可处理的 type 至少有 12 种，因此描述未准确反映实际能力范围。虽然这是同类功能内的偏差，不属于恶意 undeclared capability，但按“描述是否准确代表实际行为”的标准，属于可判定的不一致。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file’s user-facing description and usage guidance are presented in Chinese throughout, including the manifest description and all documentation sections. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This code file contains natural-language strings for the title, usage instructions, and later runtime messages entirely in Chinese, with no option for users to select another language. Under the policy rule for language/locale, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly justified, which it is not here.

Content

No source excerpt is available for this finding.

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE.txt (reported line 12)May include surrounding context.

text
permit persons to whom the Software is furnished to do so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE
FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest describes '11 种幻灯片类型' and the module docstring claims '7 种幻灯片布局', but the JSON pipeline only recognizes the concrete types handled in build_from_json: cover, section, content, two_column, table, image, summary, timeline, quote, contact, agenda, and chart. This is a semantic mismatch between advertised capabilities and implemented behavior, even though it is not a direct security issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.