Security audit

Felo Slides

Security checks for vulnerabilities and agentic risk

Overview

The skill is broadly aligned with generating slides through Felo, but it has review-worthy risks around redirectable API traffic and an unpinned installer command.

Before installing, prefer a pinned or manually reviewed source instead of the unpinned `npx` command. Use a dedicated, revocable Felo API key, do not set `FELO_API_BASE` unless you fully trust the destination, and assume any prompt used to generate slides will be sent to Felo's API.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/run_ppt_task.mjs:179
Finding: Unrestricted API Base Override Can Expose API Credentials and User Prompts
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:18
Finding: Unpinned npm Package Is Downloaded and Executed During Installation
Content: View full analysis
Remediation: View remediation
`. 2. Use a lockfile or verified integrity digest where the installation workflow supports it. 3. Identify the expected npm package publisher and registry explicitly. 4. Prefer installation from a signed release or a repository commit pinned by its full immutable commit hash. 5. Make the documented manual-copy method the preferred option when it can operate without executing third-party installer code. 6. Periodically review and update the pinned installer version through a controlled dependency-update process. 7. Advise users not to run the installation command with administrator or root privileges. ]]>

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The README instructs users to run npx skills add Felo-Inc/felo-skills --skill felo-slides without pinning a specific package/version. Because npx resolves and executes remote package code at install time, a compromised package, typo-squatted dependency, or unexpected upstream update could cause arbitrary code execution on the user's machine during installation.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill instructs use of environment variables and outbound network access to a third-party API, but it does not declare any explicit tool scope such as allowed tools or permissions. This creates an authorization and transparency gap: an agent may invoke capabilities broader than the user or platform expects, increasing the chance of unintended secret access or network actions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The description says to use the skill whenever users ask to create, make, generate, or export presentations, which is broad enough to trigger on many ordinary requests that may not require this external API workflow. Over-broad invocation can cause unnecessary external data disclosure, unintended API usage, and accidental execution of side effects when the user only wanted advice or local formatting help.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger section includes ambiguous categories like Chinese prompts about making slides and generic English words such as slides, PPT, and presentation deck. These underspecified triggers increase the chance the skill is selected for loosely related conversations, leading to unintended network calls and transmission of user content to the external provider.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The document is primarily written in English, but lines L16 and L22 switch to Chinese for key installation headings. This can create a language/locale policy issue because the skill documentation imposes mixed-language instructions without explicit user opt-in or a documented locale scope.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/run_ppt_task.mjs:192