Security audit

Slide Deck

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward slide-deck generator, but decks it creates may load third-party CDN code and should not be built from untrusted content without escaping or review.

Install only if you are comfortable generating HTML decks that load reveal.js from jsDelivr. Avoid converting untrusted or attacker-supplied markdown directly into a deck unless the agent escapes or sanitizes the content first, and review generated HTML before sharing it externally.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:66
Finding: Unpinned Remote JavaScript Dependencies Without Integrity Verification
Content: View full analysis
``` ### Technical Analysis The skill directs generated presentations to load executable JavaScript from a third-party CDN at viewing time. The dependency uses the mutable major-version selector `@5` rather than an exact audited release. It also lacks Subresource Integrity (`integrity`) and `crossorigin` attributes. Consequently, the JavaScript that eventually executes is not fully represented by the reviewed skill. Its contents can change after deck generation due to a new package release or compromise of the package publisher, package distribution infrastructure, or CDN. The implementation also conflicts with the stated requirement that generated files be self-contained. This is classified as `T08: Insecure Dependencies` because the exposure arises from relying on mutable, externally hosted third-party components without integrity controls. ### Attack Path 1. An attacker compromises the reveal.js publishing account, package distribution path, or CDN delivery infrastructure. 2. The attacker causes a malicious release or modified response to be served through the referenced `@5` URLs. 3. A user opens a slide deck generated according to the skill template while connected to the network. 4. The browser retrieves the modified JavaScript from jsDelivr. 5. The malicious JavaScript executes in the presentation's browser context. 6. The payload can read or modify deck content, manipulate navigation, issue network requests, or perform other actions available to JavaScript in that context. ### Impact Assessment Successful exploitation provides script execution in the browser context of the generated pre ...[truncated 541 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:81
Finding: Untrusted Slide Content Is Inserted Into HTML Without Required Escaping or Sanitization
Content: View full analysis

[Heading]

[Point 1]

[Point 2]

[Point 3]

``` The same direct-substitution pattern is also used for title, code, quote, attribution, and other slide fields. The skill does not instruct the implementing agent to HTML-escape text or sanitize permitted markup. ### Technical Analysis The skill accepts user-provided text, Markdown, and outlines and places the resulting values directly into HTML element bodies. Without contextual output encoding, input containing HTML can terminate or alter the intended element structure and introduce active content. For example, a crafted heading or bullet could contain an element with an event handler or another active HTML construct. If copied into the template without escaping, that markup becomes part of the generated document rather than being displayed as literal text. The issue is classified as `T09: Insecure Skill Coding Practices` because the skill's generation rules omit a necessary security control for untrusted data inserted into an executable HTML document. ### Attack Path 1. An attacker supplies presentation source material containing crafted HTML, potentially hidden inside Markdown headings, bullets, quotes, or attribution text. 2. A user asks the skill to transform that material into a slide deck. 3. Following the documented template, the agent inserts the supplied content into HTML placeholders without contextual encoding or sanitization. 4. The generated file is shared with or opened by a victim. 5. The browser interprets the injected content as active HTML rather than presentation text. 6. The injected content executes or manipulates the document when its trigger condition is met, such as document loading or interaction with a malicious eleme ...[truncated 729 chars]
Remediation: View remediation
`, `"`, and `'` as appropriate for the destination context. 3. Treat Markdown conversion output as untrusted. If limited formatting is required, process it through a maintained sanitizer with a strict allowlist. 4. Prohibit scripts, inline event handlers, iframes, active SVG, `javascript:` URLs, unsafe `data:` URLs, and other executable constructs. 5. Validate link protocols against an explicit allowlist such as `https:` and, only where required, `http:`. 6. Add a restrictive Content Security Policy that disallows inline scripts and limits network destinations. 7. Add security tests using malicious headings, bullets, quotations, code blocks, and speaker notes to verify that payloads are rendered as inert text. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The description says to use the skill when the user asks to create slides, a presentation, a deck, or a pitch, and includes generic triggers like "create a presentation" and "presentation for." These phrases are broad natural language patterns without clear scope limits or exclusions, which could cause unintended activation for ordinary conversation about presentations rather than explicit requests to invoke this skill.
Content: No source excerpt is available for this finding.

Missing User Warnings