PPTX Add Slides

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:41 AM UTC
• Version: 1.0.0

Overview

This skill is a local PPTX slide-editing helper whose file access is consistent with its stated purpose, with some hardening and quality caveats.

Install only if you are comfortable running a local script on PPTX files you trust. Prefer using a virtual environment, avoid the unnecessary dependency install unless updated instructions require it, and do not process untrusted or unusually large PPTX files without resource limits.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:94

Finding

Unnecessary Unpinned Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:94-98
Vulnerability Type: Supply-chain exposure through unnecessary, unpinned dependencies
Risk Level: Low

Vulnerable Code

markdown

### Dependency Installation

```bash
pip install python-pptx lxml

text

### Technical Analysis

The documentation instructs users to install `python-pptx` and `lxml` without version constraints or integrity hashes. However, `scripts/add_slides.py` only imports Python standard-library modules and does not use either dependency.

Installing unnecessary packages increases the attack surface without providing functionality. Because no versions or hashes are specified, package resolution depends on mutable package-index state. A compromised release, malicious transitive dependency, dependency-source misconfiguration, or unsafe package build process could execute package-controlled installation logic.

No evidence was found that the project intentionally references a malicious or misspelled package. The issue is the avoidable and uncontrolled supply-chain exposure created by the documented installation command.

### Attack Path

1. A user follows the dependency installation instructions in `SKILL.md`.
2. `pip` resolves the current releases and any applicable transitive or build dependencies from the configured package index.
3. A compromised package release, malicious package source, or unsafe build dependency supplies attacker-controlled installation logic.
4. That logic executes under the account and environment running `pip`.

### Impact Assessment

Successful exploitation through a compromised dependency could run code with the privileges of the user performing the installation. Depending on that user's permissions, this could expose accessible files, environment variables, credentials, and project data or permit modification of the Python environment.

The repository itself contains no malicious dependency implementa
...[truncated 99 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the dependency installation instruction because the current implementation uses only the Python standard library.
2. If these packages become necessary later, declare exact reviewed versions in a lock file.
3. Require package hashes, such as through a hash-locked requirements file and pip --require-hashes.
4. Review and lock transitive and build dependencies as well as direct dependencies.
5. Install dependencies in an isolated, least-privileged virtual environment from an approved package source.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/add_slides.py:250

Finding

Unbounded PPTX Decompression Can Exhaust Process Memory

Content

View full analysis

Vulnerability Details

File Location: scripts/add_slides.py:250-252
Vulnerability Type: Unbounded decompression and memory consumption
Risk Level: Medium

Vulnerable Code

python

# Open the ZIP for reading and writing
with zipfile.ZipFile(output_path, 'r') as zf:
    all_files = {name: zf.read(name) for name in zf.namelist()}

Technical Analysis

A PPTX document is a ZIP archive. The code enumerates every archive member, fully decompresses each member with zf.read(name), and retains all resulting byte strings in the all_files dictionary at the same time.

No controls are applied to:

• The number of ZIP entries
• The uncompressed size of an individual entry
• The aggregate uncompressed archive size
• The ratio between compressed and uncompressed sizes
• Duplicate or otherwise anomalous archive entries

Consequently, a small malicious PPTX with highly compressible content can expand into a much larger in-memory representation. Memory use can also substantially exceed the aggregate decompressed size due to dictionary, filename, bytes-object, XML parsing, and rewritten-archive overhead.

The script does not extract archive entries to filesystem paths, so this finding is not a ZIP path-traversal vulnerability. It is an availability vulnerability caused by unbounded archive expansion.

Attack Path

1. An attacker creates a syntactically valid PPTX containing one or more ZIP entries with a very high compression ratio or excessive declared uncompressed content.
2. The attacker supplies the PPTX to a user or workflow that invokes add_slides.py.
3. The script first copies the attacker-provided file to the selected output path.
4. The dictionary comprehension calls zf.read() for every entry and retains every decompressed entry in memory.
5. Process memory grows until the Python process raises an out-of-memory error, is terminated by the operating system, or causes resource pressur ...[truncated 581 chars]

Remediation

View remediation

Remediation Suggestions

1. Inspect every ZipInfo entry before reading any content.
2. Reject archives that exceed conservative limits for entry count, individual uncompressed size, aggregate uncompressed size, or compression ratio.
3. Account for entries with zero or unusually small compressed sizes when calculating compression ratios.
4. Read and copy archive members incrementally rather than storing the entire decompressed presentation in a dictionary.
5. Apply separate, stricter size limits before parsing XML members.
6. Run document processing with operating-system or container memory and CPU limits.
7. Catch BadZipFile, memory-related failures, malformed XML errors, and limit violations; remove incomplete output files and return a controlled error.
8. Add tests using archives with excessive entry counts, oversized XML members, and high compression ratios.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill can write files by producing a modified PPTX, but the manifest does not declare any tool scope or allowed-tools restrictions. In an agent environment, this weakens policy enforcement and can let the skill write arbitrary files or overwrite user data if the runtime grants broad filesystem access.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The argument parser declares choices ['content', 'section', 'cover'] and labels them as supported page types, but build_replacements implements logic only for 'content' and 'section'. For 'cover', the function returns no replacements, so the behavior contradicts the documented capability and would silently clone the template without applying intended cover content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The user-facing description fields are entirely in Chinese, while the manifest does not indicate that the skill is intended only for Chinese-speaking users or a China-specific context. This can violate language/locale policy expectations when skills should not force a specific language without user opt-in or documented scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file’s natural-language interface is entirely in Chinese, including the top-level description and usage guidance. Under the policy rule, forcing a specific language without opt-in is a locale/language policy concern when no alternative or user choice is provided.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The manifest describes a focused capability: adding slides into an existing deck using a template slide. In addition to that core behavior, the code introduces a broader orchestration mode that groups heterogeneous configs, repeatedly rewrites the PPTX through temporary outputs, and chains transformations across multiple passes, which is not reflected in the stated description.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.