claw-presentation-creator

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 11:02 PM UTC
• Version: 1.0.0

Overview

This skill is a straightforward PowerPoint creation guide with ordinary local file output and dependency-installation notes, with no evidence of hidden persistence, credential access, exfiltration, or destructive behavior.

Install dependencies in a virtual environment or container, review optional npm packages before use, and choose unique output paths when running examples so existing presentations or images are not overwritten.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Unpinned Third-Party Dependencies and Unrestricted Installation Scripts

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16-28
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

markdown

## Installation & Dependencies

### Required
```bash
pip install python-pptx pillow

Optional

bash

# For advanced chart support
pip install numpy

# For HTML conversion (advanced)
npm install puppeteer dom-to-pptx

text

### Technical Analysis

The installation instructions retrieve third-party Python and npm packages without pinning exact versions or verifying package integrity. No lockfile, cryptographic hashes, approved registry configuration, or reviewed version constraints are supplied.

Consequently, installation results can change over time even when the skill itself remains unchanged. Python package builds and npm lifecycle hooks may execute package-controlled code during installation. The npm command does not disable lifecycle scripts.

This creates a supply-chain exposure if an upstream package, maintainer account, package registry, or dependency is compromised. It also creates a dependency-confusion risk in environments configured to use untrusted or mixed registries. The documentation does not itself prove that any named package is malicious; exploitation depends on compromise or unsafe package resolution.

### Attack Path

1. An attacker compromises a listed package, one of its transitive dependencies, a package publisher account, or a configured package registry.
2. The attacker publishes a malicious version or causes package resolution to select an attacker-controlled artifact.
3. A user follows the documented `pip install` or `npm install` command.
4. Because no reviewed version or artifact hash is enforced, the package manager downloads the currently resolved artifact.
5. Package build logic, npm lifecycle scripts, or subsequently imported package code executes the attacker's payload.
6. The paylo
...[truncated 854 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to an explicitly reviewed version, for example through requirements.txt and package-lock.json.
2. Use Python hash verification, such as pip install --require-hashes -r requirements.txt, with hashes generated from trusted artifacts.
3. Use npm ci with a committed lockfile instead of unconstrained npm install.
4. Disable npm lifecycle scripts with --ignore-scripts when they are not required. If scripts are required, review them and document that requirement.
5. Configure package managers to use explicitly approved HTTPS registries and avoid mixing public and private namespaces without dependency-confusion controls.
6. Scan direct and transitive dependencies for known vulnerabilities and review updates before changing pinned versions.
7. Perform installation in an isolated virtual environment or container under a non-privileged account.
8. Document the expected package names, versions, registries, and integrity values so users can validate resolved artifacts.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The overview says the skill supports 'all common slide operations including ... animations' at L013. Later guidance at L617-L620 says python-pptx has limited animation support and recommends creating simple slides instead, and no animation API usage appears elsewhere in the file. This creates a clear mismatch between the advertised capability and the documented behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Because this is a markdown file, SQP-2 applies to whether the skill description warns about behaviors that affect user data or system state. The document repeatedly instructs users to save presentations and other files, but it does not include any general warning that these examples will create or overwrite local files in the current directory.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.