Keynote Video

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:05 AM UTC
• Version: 2.1.0

Overview

This PPT-to-video skill has a coherent purpose, but its generator can run unsafe shell commands from user-controlled inputs and sends narration to cloud TTS without clear disclosure.

Review before installing. Use only with trusted presentation paths and trusted generated specs, preferably in an isolated workspace. Do not process confidential decks unless you accept that narration text may be sent to the edge-tts provider. The safest fix is to replace shell-string execSync calls with argument-array process APIs, validate voice/rate values, disclose cloud TTS use, and pin dependencies.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate.js:170

Finding

OS Command Injection Through Unvalidated TTS Configuration

Content

View full analysis

/tmp/tts-command-output; #", "rate": "+15%" } } ``` The generated command would execute the injected `id` command before the TTS process completes or fails. ### Attack Path 1. An attacker supplies, modifies, ...[truncated 1220 chars]

Remediation

View remediation

50) { throw new Error('TTS rate is outside the permitted range'); } ``` 4. Validate the parsed specification against a strict JSON schema before using any field. 5. Treat LLM-generated configuration as untrusted input even when it is generated inside the workflow. 6. Add regression tests containing semicolons, quotes, command substitutions, redirections, and newline characters in all specification fields. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate.js:60

Finding

OS Command Injection Through Shell-Interpolated File Paths

Content

View full analysis

f.endsWith('.pdf') && !f.startsWith('temp_')); if (!pdfFile) { throw new Error('PDF 文件未生成'); } const pdfPath = path.join(outputDir, pdfFile); console.log(' → pdftoppm 导出 PNG...'); execSync( `pdftoppm -png -r 150 "${pdfPath}" "${outputDir}/slide"`, { timeout: 120000, stdio: 'pipe' } ); ``` The same pattern is used in FFmpeg and FFprobe commands, including: ```javascript execSync( `ffmpeg -y -loop 1 -i "${screenshot}" -i "${audioFile}" ` + `-c:v libx264 -tune stillimage -c:a aac -b:a 128k -pix_fmt yuv420p ` + `-vf "scale=1280:720:force_original_aspect_ratio=decrease,pad=1280:720:(ow-iw)/2:(oh-ih)/2" ` + `-shortest -movflags +faststart "${clipFile}"`, { stdio: 'pipe' } ); ``` ### Technical Analysis The script resolves paths with `path.resolve()`, but canonicalization does not make a value safe for insertion into a shell command. Attacker-influenced values such as the slides path, output directory, project directory, and derived filenames are interpolated into strings passed to `execSync()`. Double quotes prevent simple whitespace splitting but do not neutralize all shell syntax. In particular, command substitutions such as `$(command)` and backtick expressions are evaluated inside double-quoted shell strings. Embedded double quotes can also terminate the intended quoted argument and introduce additional commands. A presentation filename containing literal shell syntax can therefore cause command execution when the script constructs ...[truncated 1617 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:304

Finding

Unpinned Python Dependency Installation Creates Supply-Chain Exposure

Content

View full analysis

Remediation

View remediation

PyMuPDF== ``` 2. Maintain a lock or requirements file containing cryptographic hashes: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Install dependencies inside a dedicated virtual environment rather than the global Python environment: ```bash python3 -m venv .venv . .venv/bin/activate python3 -m pip install --require-hashes -r requirements.txt ``` 4. Pin and review transitive dependencies using a reproducible dependency-management process. 5. Use an approved package index or internal mirror and verify package provenance. 6. Remove instructions recommending unrestricted installation and point all setup and troubleshooting documentation to the same locked dependency file. 7. Periodically update pinned versions through a controlled review process that includes vulnerability and integrity scanning. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents a full presentation-to-broadcast-video system with multiple AI-driven stages and final automatic synthesis. The actual code chunk only implements an early preprocessing/helper step: extracting text from PPTX or PDF files into Markdown for later use. This is related to the broader domain, but it is materially narrower than the declared purpose and lacks the headline capabilities described. Therefore the description does not accurately represent what this supplied code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

描述把该技能表述为包含内容理解与生成能力的端到端PPT转播报视频系统，而这段代码只是其中“纯技术合成脚本”部分。代码行为与注释都清楚表明：输入必须提供PPT/PDF、讲稿目录和输出目录；脚本不会从PPT生成讲稿，不会进行内容分析、风格判定或改写，也没有任何LLM调用。所谓‘支持7种风格’在代码中并未体现为风格模板或生成逻辑，只是可从spec读取每页voice/rate参数。虽然“自动合成视频”这一部分与描述部分一致，但整体声明的核心能力明显超出该代码实际实现范围，因此属于实质性描述-行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents a PPT-to-narrated-video generation pipeline driven by content evaluation and LLM-based script creation. The supplied code does not generate videos from PPTs, evaluate presentation content, create narration scripts, rewrite speaking style, confirm plans, or synthesize output. Instead, it performs post hoc technical validation on an already existing video file. While video quality verification could be a supporting part of a larger PPT-to-video system, this code chunk's actual purpose is specifically QA/inspection, which is not represented in the declared description. Therefore this chunk is materially mismatched with the declared purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The design hard-codes Chinese TTS voices and presentation styles without an explicit user language or locale selection step. This can cause the system to misread non-Chinese content, distort names, numbers, or terms, and silently produce misleading output that users may trust as accurate. In this skill’s context, the issue is more credible because the workflow automates end-to-end generation and only asks for style confirmation, not language suitability.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The primary descriptive text is presented in Chinese only, and the document does not offer an alternative language option or state that the skill is intentionally region- or locale-specific. This can violate language/locale policy requirements when users are not given a choice or opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger phrases include very broad natural-language prompts like '生成视频' and '做视频', which can cause the skill to activate in contexts unrelated to PPT-to-video conversion. Over-broad invocation increases the chance that the agent processes unintended files or launches a workflow the user did not mean to authorize, especially in environments with multiple skills and file access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documented style table hard-codes zh-CN voices such as XiaoxiaoNeural, YunxiNeural, YunjianNeural, and XiaoyiNeural, and the surrounding instructions assume Chinese-script narration conventions. The file does not indicate that users can choose another language or locale, so it imposes a locale-specific behavior by default.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 308)May include surrounding context.

pip install PyMuPDF # PDF 文字提取（可选）

系统依赖

sudo apt-get install poppler-utils # pdftoppm

text

---

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest describes a PPT-to-video skill with LLM-driven content evaluation, script generation, and automatic synthesis, but this file relies on arbitrary local executable invocation via child_process.execSync. While media conversion itself is expected, giving the skill the ability to invoke shell commands and external binaries materially expands its capability beyond the manifest’s stated functional intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The default voice is fixed to zh-CN-YunxiNeural, which imposes a specific language/locale choice on all users unless they provide a spec override. This is a natural-language locale policy concern because the script does not offer an explicit user language selection or opt-in for the forced locale.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script sends full narration text to edge-tts, which typically relies on a remote Microsoft TTS backend, but the user is not explicitly warned that slide-derived script content may leave the local environment. If the narration contains confidential business, personal, or regulated data, this can cause unintended data disclosure to a third party.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script's comments, usage text, status messages, and errors are all presented in Chinese, which constitutes a fixed language choice in natural-language content. There is no opt-in, fallback, or documented justification that this skill is intentionally limited to Chinese-speaking users or a region-specific context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The entire template, including headings, confirmation checklist, and user action prompts, is written only in Chinese. This imposes a specific language on users without any visible opt-in or alternative, which matches the policy concern for language/locale constraints in natural-language content.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest description says the skill converts PPT/presentations into narrated videos and supports six speaking styles, but it does not specify explicit trigger phrases, invocation boundaries, or exclusions. In a manifest file, this kind of broad natural-language description can overlap with many common presentation or video-related requests and may cause unintended activation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This is a natural-language policy issue because the file presents its description, usage guidance, and later runtime messages in a single language with no alternative or opt-in mechanism. Users who do not read Chinese may be unable to understand the tool’s purpose or warnings.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The script creates directories and writes generated video/report artifacts into the user-specified output path, including VIDEO_COMPLETE.md, and also writes intermediate files in temp directories. While these writes are part of the tool's purpose, there is no explicit disclosure that existing files may be created or overwritten, especially because downstream ffmpeg -y forces overwrite behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The visible natural-language template headings and labels are all in Chinese, which can impose a specific language on generated output without any stated user opt-in or documented locale restriction. Under the policy, forcing a specific language is a reportable natural-language violation unless the file offers a language choice or clearly justifies the locale constraint.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/generate.js:60