ppt-style-matcher

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:48 AM UTC
• Version: 4.1.0

Overview

The skill is mostly a coherent PowerPoint style-matching helper, but it includes a hard-coded presentation-wide text replacement step that could silently alter unrelated slide content.

Review this skill before installing if you will use it on business-critical presentations. The PPT analysis and slide-generation parts are purpose-aligned, but do not run the documented global residual-keyword replacement unless you have reviewed the exact replacements and want them applied across the whole deck. For non-Chinese decks, adjust the font/language assumptions before use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 81% confidence
• Finding: The skill documents file-reading and code-driven manipulation of PPT content but declares no explicit tool scope or permissions boundary. In an agent environment, this can enable broader-than-expected filesystem access because operators and policy layers cannot clearly constrain what the skill is allowed to read.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The workflow expands from style matching into generic content generation and external research, which materially broadens the skill's authority beyond its stated purpose. This creates scope creep risk: an agent invoked for formatting could begin synthesizing or importing substantive content, increasing the chance of unapproved data use, hallucinated material, or policy-bypassing behavior.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill includes external search as an available capability even though its stated purpose is PPT style matching. Unnecessary external retrieval increases attack surface and data-governance risk, especially if slide content or context is sent to outside services during research.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The instructions state that East Asian font handling is mandatory and hard-code `Noto Sans SC` for text runs, which effectively forces a specific Chinese locale/font behavior. The file does not offer user choice or explain a justified region-specific constraint, so this appears to violate the language/locale policy requirement.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The documented code performs presentation-wide text rewriting, replacing keywords across all slides regardless of whether they are part of the requested style operation. This is dangerous because it can silently alter business content, names, branding, or sensitive terminology outside the target pages, causing integrity loss and potentially unauthorized document tampering.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The file title and the entire guidance are written in Chinese, and line L341 explicitly states requirements for handling Chinese content. There is no indication that language selection is optional or that the skill is intentionally limited to a China-specific or Chinese-only context, which creates a locale policy concern under the natural-language policy rule.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The manifest and module header describe this skill as extracting and analyzing PPT design/style information, but the code also defines write-oriented helpers that modify run XML, paragraph XML, shape XML, and repack PPTX contents. Those behaviors go beyond analysis and introduce document-editing capability not reflected in the skill description.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The docstring says `full_cleanup` performs full cleanup of shadow/3D/connector residues in XML, but inside the loop it merely checks for marker tags and executes `pass`, then writes the original data back unchanged. This is an active contradiction between the function's stated intent and its actual behavior.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: This code file includes its title, description, usage output, and user-facing messages exclusively in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified, which is not present here.

Static analysis

No suspicious patterns detected.