KAIFA辅助SKILL01

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:10 AM UTC
• Version: 3.0.0

Overview

The skill is a coherent presentation generator, but its HTML output can embed untrusted slide text as active HTML or JavaScript.

Review generated HTML carefully before sharing, especially if slide content came from an untrusted source. Prefer escaping or sanitizing all slide text and allowlisting layout/icon identifiers before rendering, and pin python-pptx if you use the PPTX exporter. Be aware that generated HTML loads Google Fonts unless the template is changed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:186

Finding

Unescaped presentation data can be injected into generated HTML

Content

View full analysis

special 类型: template 已自带

，直接使用 4. 按 page 排序 → 拼接所有

拼接所有

→ 注入 {{slides}} 占位 → 完整HTML ``` `assets/base-template.html:265-268`: ```html {{icons}} {{slides}} ``` `references/content-areas/ca-bullets.html:5-17, 32-38`: ```html {{#if title}}

{{title}}

{{/if}}

{{#each points}}
• {{text}} {{#if sub}}

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Unbounded dependency version permits unreviewed future releases

Content

View full analysis

=1.0.0 ``` ### Technical Analysis The dependency declaration specifies only a minimum version. A fresh installation can therefore resolve to any future `python-pptx` release satisfying the constraint. The project does not provide a lock file or package hashes in the audited material. This is a supply-chain hardening weakness because the code installed and imported during future builds may differ from the version originally reviewed. A compromised, malicious, or unexpectedly incompatible future release could be incorporated automatically without a corresponding source change in this project. The audited dependency name is legitimate, and no evidence indicates that the currently selected package is malicious. The risk arises from unconstrained future resolution rather than from a confirmed malicious package. ### Attack Path 1. A user or automation environment installs dependencies from `requirements.txt`. 2. The package resolver selects the newest available release satisfying `python-pptx>=1.0.0`. 3. If that release or one of its resolved transitive dependencies has been compromised, the unreviewed code is installed. 4. The exporter imports the package when `scripts/export_pptx.py` starts. 5. Malicious package behavior could then run with the privileges of the user executing the exporter. This path depends on a compromised or malicious upstream release; the project does not itself retrieve executable payloads from arbitrary URLs. ### Impact Assessment If dependency resolution selects a compromised package, its code could execute with the same operating-system privileges as the exporter process. Depending on the execution environment, that could expose files accessible to that user, alter generated output, ...[truncated 323 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (23)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

声明的核心能力是“生成 HTML 演示文稿”，强调固定 1280×720 画布、单文件自包含和键盘翻页，这通常对应网页式幻灯片生成器。但代码并不生成 HTML，也没有任何浏览器交互、键盘事件、嵌入资源或单文件 HTML 打包逻辑。相反，它是一个将 content_data.json 渲染为 .pptx 的导出引擎，主要职责是版式排版和保存 PowerPoint 文件。虽然两者都属于“做 PPT/演示文稿”的大类，但主要输出形态和实现能力存在实质差异，因此应判定为描述与实际行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description centers on producing HTML-based slideshow presentations with fixed canvas and keyboard navigation. The actual code does not implement or test HTML presentation generation at all; instead, it tests a PowerPoint .pptx export pipeline using python-pptx and a CLI that reads JSON and writes .pptx files. While both are presentation-related, the primary output format and behavior are materially different. The described trigger phrases and automatic mode/topic workflow are also not reflected in this code chunk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill describes capabilities that involve reading files, writing output files, and invoking a shell command, but it does not declare any explicit tool scope or permission boundary. In an agent environment, this creates an authorization gap: the orchestrator may permit broader filesystem or command execution than users expect, increasing the chance of unintended file access, overwrite, or command execution via later implementation details.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill description and operational instructions are written as though the workflow operates in Chinese by default, and later sections hard-code Chinese font choices and examples. There is no indication that users may opt into another language or that the skill is intentionally restricted to a Chinese-only region or compliance context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Using presentation as a standalone English trigger is especially ambiguous and likely to match benign user conversation. In context, the skill can proceed into a multi-phase generation pipeline and output files, so an overly generic trigger increases the risk of unintended invocation and associated side effects.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Using presentation as a standalone English trigger is especially ambiguous and likely to match benign user conversation. In context, the skill can proceed into a multi-phase generation pipeline and output files, so an overly generic trigger increases the risk of unintended invocation and associated side effects.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file specifies "Noto Sans SC" as the single-font design standard, which implies a Simplified Chinese locale preference. Without opt-in or documented regional justification, this creates a language/locale policy issue because the skill appears to force one locale-specific presentation style for all users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The HTML root sets lang="zh-CN", which hard-codes a specific language/locale for the rendered output. The file also contains Chinese UI text, but there is no indication in this file that users can opt into another locale or that the template is intentionally limited to a China-specific context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Line L026 states '中文为主' and restricts English usage to subtitles or labels, which is a language-policy constraint expressed as a hard rule. The file does not offer a user language preference or explain a justified region-specific requirement, so this is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Line L003 states '固化设计语言', which fixes the design language, and the document consistently specifies Chinese text conventions such as Chinese titles and labels without any opt-in or alternative locale path. This creates a natural-language locale constraint that appears mandatory rather than user-selectable.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code emits user-facing CLI messages in Chinese, beginning with the dependency error string, and continues this pattern throughout the script. For a general-purpose export tool, forcing a specific language without offering a choice or documenting a justified locale restriction is a natural-language policy violation under the locale policy rule.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The command-line description, argument help, and status/error messages are presented to users in Chinese, but the file does not offer any language choice or indicate that the tool is region-specific. That creates a locale policy issue because the skill imposes one language on all users by default.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill claims to generate a self-contained single-file presentation, but the document depends on remote font resources. This mismatch undermines trust in the output contract and can cause privacy leakage, broken rendering, or operational failure where outbound network access is blocked.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The HTML test render fetches fonts from Google Fonts, which creates an external network dependency and breaks the expected self-contained/offline behavior of the PPT generator. This can leak access metadata such as IP address and user agent to a third party, and the presentation may fail or render inconsistently in offline or restricted environments.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_export_pptx.py (reported line 150)May include surrounding context.

python

script = os.path.join(
        os.path.dirname(__file__), "..", "scripts", "export_pptx.py"
    )
    result = subprocess.run(
        [
            sys.executable,
            script,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_export_pptx.py (reported line 170)May include surrounding context.

python

script = os.path.join(
        os.path.dirname(__file__), "..", "scripts", "export_pptx.py"
    )
    result = subprocess.run(
        [
            sys.executable,
            script,

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This description broadens invocation expectations while leaving unclear exactly which utterances should activate the skill beyond a few examples. Because no negative examples or precise activation boundaries are given, the trigger scope remains ambiguous.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The visible navigation hint ← → 翻页 is fixed to Chinese text, which enforces a specific language in the user-facing interface. There is no accompanying mechanism in this file for localization or user selection of language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file's natural-language comments describe the component exclusively in Chinese ("三列等宽卡片，适用于方案/类型/对比"), which indicates a fixed language/locale choice in the skill content. Under the policy, forcing a specific language without user opt-in or documented justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The HTML comment on L01 describes the template in Chinese ("四列卡片，2×2网格"). Because SQP-3 applies to all file types and covers language/locale policy violations, this is a natural-language restriction with no visible opt-in, alternative language, or justification that the skill is intended only for Chinese users.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The dependency is specified with a lower-bound range (python-pptx>=1.0.0) rather than an exact pinned version, which makes builds non-reproducible and allows future package releases to be pulled in automatically. If an upstream release is compromised, malicious, or introduces a vulnerable transitive dependency, installations of this skill could unexpectedly inherit that risk.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

python-pptx>=1.0.0

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The HTML root sets lang="zh-CN", and the visible interface text throughout the file is Chinese-only. Under the policy rule for language/locale, this is a natural-language constraint that does not offer user opt-in or language selection, and the file does not clearly document a region-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This code file contains natural-language string literals entirely in Chinese for titles and slide content, but provides no indication that the skill is region-specific or that language choice is optional. Under the stated policy, forcing a specific language without opt-in can be a locale-policy issue even when it appears in tests.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.