ClawHub
Back to skill

Security audit

Web Slides

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its slide-generation purpose, but its optional preview path is overbroad and its install guidance adds unnecessary supply-chain risk.

Review this skill before installing. Avoid the optional global npm install unless the package is pinned and trusted. Only run preview rendering on HTML generated from trusted content, preferably in an isolated environment without access to private files or outbound network access.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:169
Finding

Unpinned and Unused Global npm Package Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:169
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code

markdown
- 如需预览渲染功能，用户需手动安装：`npm install -g @aspect-ratio/preview-renderer`（本 skill 不会自动安装任何包）

The instruction tells users to run:

bash
npm install -g @aspect-ratio/preview-renderer

Technical Analysis

The documentation recommends installing a third-party npm package globally without pinning a reviewed version or verifying package integrity. npm will consequently resolve whichever release is current when the command is executed.

Package installation may execute npm lifecycle scripts with the permissions of the invoking user. Because the installation is global, it also modifies the user's shared Node.js environment rather than an isolated project environment.

No reviewed project script imports or invokes @aspect-ratio/preview-renderer. The implemented preview workflow directly invokes a Chrome executable through scripts/chrome-utils.mjs. The recommended package therefore creates unnecessary supply-chain exposure and does not correspond to the implementation reviewed during this audit.

Attack Path

  1. A user follows the documented preview-rendering prerequisite.
  2. npm resolves the current release of @aspect-ratio/preview-renderer because the command specifies neither a version nor an integrity hash.
  3. npm downloads the package and its transitive dependencies.
  4. Any permitted installation lifecycle scripts execute with the user's npm permissions.
  5. If the package, a maintainer account, or a transitive dependency has been compromised, the installation can execute attacker-controlled code.
  6. The package is installed into the global Node.js environment, increasing its scope and persistence relative to a project-local installation.

Impact Assessment

A compromised package release could execute code with ...[truncated 441 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the global installation instruction because the reviewed preview implementation does not use this package.

  2. Document the supported Chrome dependency and the CHROME_BIN configuration instead.

  3. If the package becomes necessary, add it as a project-local dependency rather than a global dependency.

  4. Pin an exact reviewed version and commit an appropriate lockfile.

  5. Review the package's source, maintainers, transitive dependencies, provenance, and lifecycle scripts before adoption.

  6. Disable lifecycle scripts during installation where compatible with the package:

    bash
    npm install --ignore-scripts --save-exact package-name@reviewed-version

  7. Use package integrity and provenance controls in the release process, and periodically review dependency updates before accepting them.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/chrome-utils.mjs:13
Finding

Arbitrary Local HTML Rendered with File-Origin Access Enabled

Content
View full analysis

Vulnerability Details

File Location: scripts/chrome-utils.mjs:13-29; related input flow at scripts/render-preview.mjs:32-39
Vulnerability Type: Unsafe rendering of potentially untrusted HTML with relaxed local-file access
Risk Level: Medium

Vulnerable Code

scripts/chrome-utils.mjs:13-29:

js
const args = [
  "--headless=new",
  "--disable-gpu",
  "--no-first-run",
  "--no-default-browser-check",
  "--allow-file-access-from-files",
  `--window-size=${width},${height}`,
  `--screenshot=${outputPath}`,
];

if (fullPage) args.push("--hide-scrollbars");
args.push(inputUrl);

try {
  execFileSync(chromePath, args, {
    stdio: ["ignore", "pipe", "pipe"],
    encoding: "utf8",
  });

scripts/render-preview.mjs:32-39:

js
const inputPath = path.resolve(process.cwd(), args.input);
const outputPath = path.resolve(process.cwd(), args.output || inputPath.replace(/\.html?$/i, args.mobile ? ".mobile.png" : ".png"));

fs.mkdirSync(path.dirname(outputPath), { recursive: true });

renderHtmlToPng({
  inputUrl: `file://${inputPath}`,
  outputPath,

Technical Analysis

The preview utility accepts an arbitrary path through --input, converts it to a file:// URL, and opens it in headless Chrome. Chrome is explicitly started with --allow-file-access-from-files, which relaxes normal restrictions between local-file origins.

HTML generated by generate-slide-html.mjs escapes external slide fields, but render-preview.mjs does not verify that its input was produced by that generator. A caller can therefore provide a separately crafted HTML document containing active JavaScript.

The Chrome process is not given a dedicated temporary profile, network isolation, an allowlisted input directory, or a restricted filesystem view. A malicious local document can consequently attempt to read other local resources available to Chrome and transmit recovered information using ...[truncated 1876 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove --allow-file-access-from-files unless a documented and reviewed feature strictly requires it.

  2. Restrict preview input to files generated by the Skill or to a dedicated, canonicalized output directory.

  3. Reject paths outside that directory after resolving symbolic links and canonical paths.

  4. Create a fresh temporary Chrome profile for each render and delete it afterward:

    js
    `--user-data-dir=${temporaryProfileDirectory}`

  5. Run preview rendering in an isolated container or sandbox that mounts only the deck and output directory.

  6. Disable outbound networking for the rendering process when previews do not require network resources.

  7. Add a restrictive Content Security Policy to generated decks, such as prohibiting remote connections and external resources.

  8. Consider rejecting arbitrary HTML and accepting only validated structured content, generating the HTML immediately before rendering.

  9. Construct local URLs with Node.js pathToFileURL() instead of manual file:// concatenation to ensure correct path encoding:

    js
    import { pathToFileURL } from "node:url";
const inputUrl = pathToFileURL(inputPath).href;

  10. Document that previewing third-party or otherwise untrusted HTML is unsupported and unsafe unless rendering occurs inside the hardened sandbox.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (24)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md
主 `SKILL.md` 只保留路由和生成规则。需要细节时按需读取：

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The '何时使用' section includes broad triggers like users wanting PPT, slides, presentations, pitch decks, launch pages, or report drafts. Although domain-related, the activation scope is still wide and lacks negative examples or exclusion criteria clarifying when this skill should not be invoked versus other content-generation skills.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The workflow explicitly states '输出单文件 HTML 演示文稿', which enforces Chinese output behavior without indicating that the user's preferred language should control the response. This can cause the agent to ignore user language expectations, reduce usability, and create prompt-conflict behavior where system-like skill instructions override user intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The instruction '不要为每一页重新发明版式' and the rest of the file are written entirely in Chinese, effectively enforcing a specific language/locale for the skill guidance. The file does not provide any opt-in, alternative language choice, or justification that this skill is intended only for a Chinese-language or region-specific context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The guidance specifies output constraints in Chinese, including limits such as "标题最好不超过 16 个中文字符" and uses Chinese-language quality criteria throughout. This effectively imposes a specific language/locale expectation without any opt-in or explanation that the skill is intended only for a Chinese-language context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file contains user-facing natural language exclusively in Chinese across the substantive content. The policy requires flagging language or locale constraints when a skill forces a specific language without user opt-in, and no alternative language option or justification is provided here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The usage instructions are written as imperative Chinese guidance ('先根据用户场景和调性选主题，再读取对应单主题文件', '优先选择最贴合的一个主题') and do not provide any opt-in or alternative language behavior. Under the policy, forcing a specific language or locale without user choice is a natural-language policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file uses Chinese throughout its user-facing instructions and descriptions, which can force a specific language on users without opt-in. The policy explicitly flags language or locale constraints unless the skill offers a choice or clearly documents a justified region-specific limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This markdown file contains user-facing natural-language guidance exclusively in Chinese, including positioning, usage notes, and mobile guidance. Under the policy, forcing a specific language without user opt-in or justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This markdown file contains user-facing instructions exclusively in Chinese, including positioning, usage scenes, and design guidance. Because the skill does not offer multilingual support, user opt-in, or a documented region-specific justification, it may violate a language/locale policy requiring language choice rather than forcing a single language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The natural-language content of the skill file is entirely written in Chinese, which imposes a specific language/locale on users without any opt-in, alternative language option, or documented regional justification. Under the policy, language constraints should either be optional for the user or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This code launches a Chrome subprocess via execFileSync and writes a screenshot to the path provided in outputPath, but there is no confirmation prompt, user-facing log/print, or explanatory comment/docstring disclosing those actions. For a code file, subprocess execution and file writes are safety-relevant operations that should include some visible warning unless clearly disclosed elsewhere.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The generated document sets <html lang="zh-CN">, and the script also supplies multiple default Chinese strings for slide titles and subtitles. This forces a specific language/locale for all generated output with no option for user choice or explicit justification, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The generated page declares lang="zh-CN" and includes Chinese-only descriptive text, which forces a specific language/locale in the output. This file provides no indication that the locale is optional, user-configurable, or justified as a region-specific tool.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The description is partially in Chinese and partially in English, while the rest of the document primarily instructs behavior in Chinese. This can amount to a language/locale policy issue because the skill does not state that output language should follow user preference or offer an opt-in choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown documentation uses Chinese instructional text throughout key sections such as the goal, usage, and recommendation, but does not indicate that the language is optional or region-specific. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The file's descriptive content is entirely written in Chinese, with no indication that the skill is region-specific or that users may choose another language. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The file's descriptive content and guidance are written entirely in Chinese, which can amount to an implicit language constraint for users consuming or maintaining the skill. The file does not offer an alternative language option or explain a region-specific requirement that would justify the locale restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown file presents all user-facing guidance in Chinese, which can constitute a language/locale policy violation when no opt-in, alternative language, or justification is provided. The file does not indicate that the skill is region-specific or that users can select their preferred language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file contains user-facing natural-language instructions exclusively in Chinese, which may impose a language/locale constraint on users without opt-in. The file does not indicate that the skill is region-specific or provide an alternative language option.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The file’s natural-language content is entirely in Chinese while headings remain in English, with no indication that Chinese output is optional or that the skill is intentionally limited to a Chinese-speaking audience. Under the language/locale policy, forcing a specific language without user opt-in is a policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The generated HTML hard-codes lang="zh-CN", which imposes a specific locale on all output regardless of user preference. This matches the language/locale policy concern because the file does not offer a language choice or explain why the output must be Chinese-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The script creates a temporary directory and later writes JSON and HTML artifacts into it, but the only user-visible output is a final success object. There is no upfront notice, confirmation, or comment/docstring warning that running the script will create files on disk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The helper wraps execFileSync to run multiple scripts with inherited stdio, which is a subprocess operation covered by the warning rule for code files. Although this is expected in a smoke-test utility, this file itself provides no inline warning, prompt, or explanatory comment about invoking child processes.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/build-preview-gallery.mjs:28

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/chrome-utils.mjs:27

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/generate-theme-gallery.mjs:34

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/smoke-test.mjs:13