pptx

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:29 AM UTC
• Version: 0.1.0

Overview

This PowerPoint skill is mostly aligned with presentation work, but it needs review because it uses broad local file and install operations without strong containment.

Install only if you are comfortable with a skill that runs local document-conversion tools, edits Office files, and may require system/global dependency installation. Use it on trusted PPTX files or in a sandboxed workspace, avoid running the install commands with elevated privileges unless necessary, and keep backups before template replacement because missing replacement entries can clear slide text.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: ooxml/scripts/unpack.py:16

Finding

Unbounded extraction of untrusted Office archives permits resource exhaustion

Content

View full analysis

Vulnerability Details

File Location: ooxml/scripts/unpack.py:16-17; ooxml/scripts/validation/base.py:890-891; ooxml/scripts/validation/docx.py:200-201; ooxml/scripts/validation/redlining.py:69-70
Vulnerability Type: Unbounded archive extraction and decompression bomb exposure
Risk Level: Medium

Complete Vulnerable Code

Primary extraction path in ooxml/scripts/unpack.py:16-17:

python

output_path.mkdir(parents=True, exist_ok=True)
zipfile.ZipFile(input_file).extractall(output_path)

Equivalent extraction in ooxml/scripts/validation/redlining.py:69-70:

python

with zipfile.ZipFile(self.original_docx, "r") as zip_ref:
    zip_ref.extractall(temp_path)

The same unrestricted extractall() pattern is also present in:

python

# ooxml/scripts/validation/base.py:890-891
with zipfile.ZipFile(self.original_file, "r") as zip_ref:
    zip_ref.extractall(temp_path)

python

# ooxml/scripts/validation/docx.py:200-201
with zipfile.ZipFile(self.original_file, "r") as zip_ref:
    zip_ref.extractall(temp_dir)

Technical Analysis

PPTX, DOCX, and XLSX files are ZIP archives. These extraction paths accept document archives and extract every member without first enforcing limits on:

• Total uncompressed size
• Per-member uncompressed size
• Number of archive members
• Compression ratio
• Available disk space
• Overall extraction time

A malicious Office file can contain highly compressible data that occupies little space in the uploaded archive but expands to a very large size. It can also contain an excessive number of small files, imposing substantial filesystem and CPU overhead.

Although temporary directories limit where several validation paths write their data, they do not prevent exhaustion of the filesystem containing the temporary directory. The standalone unpacking path writes into a caller-selected output directory and is similarly unbou ...[truncated 1138 chars]

Remediation

View remediation

Remediation Suggestions

Replace direct extractall() calls with a controlled extraction routine that:

1. Iterates through ZipFile.infolist() before writing any member.
2. Rejects archives exceeding a conservative member-count limit.
3. Rejects members exceeding a per-file uncompressed-size limit.
4. Tracks and limits the cumulative uncompressed size.
5. Rejects suspicious compression ratios.
6. Verifies that each resolved destination remains beneath the intended extraction directory.
7. Rejects absolute paths, parent-directory components, and unsupported link-like entries.
8. Extracts incrementally while enforcing byte limits rather than trusting archive metadata alone.
9. Applies process timeouts, filesystem quotas, and isolated temporary storage.
10. Deletes partially extracted content after any validation or quota failure.

Apply the same hardened helper consistently in unpack.py, validation/base.py, validation/docx.py, and validation/redlining.py.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:477

Finding

Third-party dependency installation instructions use mutable unpinned releases

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:477-484
Vulnerability Type: Unpinned dependency installation and supply-chain exposure
Risk Level: Medium

Complete Vulnerable Code

markdown

- **markitdown**: `pip install "markitdown[pptx]"` (for text extraction from presentations)
- **pptxgenjs**: `npm install -g pptxgenjs` (for creating presentations via html2pptx)
- **playwright**: `npm install -g playwright` (for HTML rendering in html2pptx)
- **react-icons**: `npm install -g react-icons react react-dom` (for icons)
- **sharp**: `npm install -g sharp` (for SVG rasterization and image processing)
- **LibreOffice**: `sudo apt-get install libreoffice` (for PDF conversion)
- **Poppler**: `sudo apt-get install poppler-utils` (for pdftoppm to convert PDF to images)
- **defusedxml**: `pip install defusedxml` (for secure XML parsing)

Technical Analysis

The pip and npm commands do not specify reviewed versions, lockfiles, or integrity hashes. They therefore resolve whichever release is current when the instructions are followed. The effective dependency code can change after the Skill itself has been reviewed.

The npm commands additionally request global installation. Depending on the runtime configuration, package installation can execute package-controlled lifecycle scripts and modify globally available tooling. Python packages can likewise execute build-backend code when installation requires a source build.

No evidence was found that the named dependencies are currently malicious or typosquatted. The issue is that the instructions do not provide reproducible or integrity-verified dependency resolution, leaving the Skill exposed to future package compromise, account takeover, or incompatible mutable releases.

Attack Path

1. A required package release or maintainer account is compromised, or a future release introduces malicious installation behavior.
2. An Agent environment lacks the ...[truncated 1168 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every pip and npm dependency to an explicitly reviewed version.
2. Provide lockfiles with package integrity metadata.
3. For Python, use a requirements or lock file with cryptographic hashes and install into an isolated virtual environment.
4. For Node.js, use a project-local package manifest and lockfile rather than global installation.
5. Prefer deterministic installation commands such as npm ci.
6. Disable npm lifecycle scripts where they are unnecessary and compatible with the required packages.
7. Run package installation in a sandbox without credentials or sensitive mounted directories.
8. Periodically scan pinned dependencies for known vulnerabilities and intentionally review upgrades.
9. Pin operating-system package sources to trusted repositories and avoid running package-management operations from the document-processing runtime where possible.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (35)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a user-facing presentation manipulation skill focused on creating and editing .pptx files. The supplied code instead implements a low-level Office packaging tool: it takes an unpacked document directory, rewrites XML files to condense formatting, zips the contents into an Office file, and optionally validates it by invoking LibreOffice. While .pptx support is included, the code is not primarily about creating/editing presentation content, layouts, comments, or speaker notes. It also supports .docx and .xlsx, which expands beyond the declared scope. This is a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description promises presentation-focused capabilities such as creating, modifying, and analyzing .pptx files. The supplied code instead performs generic OOXML package unpacking and XML pretty-printing across multiple Office formats, which is a lower-level file-inspection utility rather than a presentation authoring or editing tool. While unpacking a .pptx could support presentation analysis, the code’s actual scope is materially different and broader than declared, including .docx/.xlsx handling and a Word-specific tracked-changes helper. This is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description centers on presentation creation, editing, and general presentation-task support for .pptx files. The supplied code instead implements a command-line validator for unpacked Office document contents, selecting schema validators based on the original file extension. For .pptx it validates schema compliance; for .docx it validates both schema and redlining/tracked changes. This is materially different from creating or modifying presentation content, layouts, comments, or notes. While 'analysis' could loosely include validation, the actual behavior is specifically Office XML/XSD validation and tracked-change checking across multiple Office formats, especially .docx, which is not accurately represented by the presentation-editing description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a broad presentation-manipulation skill focused on creating and editing .pptx files. The supplied code does not implement presentation creation or editing; it only aggregates validator classes. It also explicitly includes DOCX and redlining validators, which are outside the declared presentation-only scope. While PPTX validation is somewhat related to presentation analysis, the primary purpose of this code chunk is schema validation across multiple document types, making it a materially different and broader behavior than the description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents the skill as a presentation manipulation tool focused on creating and editing .pptx content. The supplied code instead implements a generic Office Open XML validator base class. Its functionality is centered on technical validation of unpacked OOXML packages: XML parsing, namespace checks, uniqueness constraints, relationship integrity, content type declarations, and XSD schema validation. While PowerPoint is included, the code is not for presentation creation or editing, and it also explicitly supports Word and Excel. That makes the primary purpose materially different from the declared presentation-authoring description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description says the skill is for presentation creation, editing, and analysis of .pptx files. However, the supplied code is specifically for validating WordprocessingML documents in .docx files. It uses Word-specific namespaces and elements, parses word/document.xml, checks revision markup rules, and compares paragraph counts in Word documents. This is not a supporting implementation detail of presentation handling; it is a materially different document type and primary purpose. Therefore the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description promises a general-purpose presentation skill for creating, editing, and analyzing PowerPoint files. The supplied code does not create or modify presentations at all; instead, it validates internal PPTX XML structure and relationships against schema and integrity rules. While validation could loosely fall under 'analysis,' the primary purpose is much narrower and materially different from the broad editing/creation functionality described. Therefore the description does not accurately represent the actual behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is about presentation-related functionality for .pptx files, including creating and editing slides. The supplied code is specifically a validator for tracked changes in Word documents, as indicated by the module docstring, class name, use of word/document.xml, and handling of w:ins/w:del tags in WordprocessingML. Its primary purpose is document redlining validation, not presentation manipulation. This is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description presents a broad presentation authoring/editing skill, but the supplied code only analyzes existing PowerPoint files and exports structured text/formatting/position data to JSON. Its primary purpose is extraction and issue detection, not presentation creation or modification. While 'analysis' is partially covered by the declaration, the description materially overstates the implemented capabilities by implying write/edit operations and broader presentation handling that are absent from the code.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

md

3. Create and run a JavaScript file using the [`html2pptx.js`](scripts/html2pptx.js) library to convert HTML slides to PowerPoint and save the presentation

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · ooxml.md (reported line 19)May include surrounding context.

Basic Slide Structure

xml

<!-- ppt/slides/slide1.xml -->
<p:sld>
  <p:cSld>
    <p:spTree>

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill instructs use of shell commands, file reads/writes, and environment-dependent tooling, yet declares no explicit tool scope or permission boundaries. In an agent setting this increases the blast radius of prompt-triggered execution because the model may invoke powerful capabilities without a least-privilege contract.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The invocation text includes a broad catch-all phrase like 'any other presentation tasks,' which can cause the agent to activate this skill in loosely related contexts. Combined with shell/file guidance and absent tool scoping, broad triggering increases the chance of unnecessary access to local files and command execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instructions state that all text shapes will be cleared automatically unless replacement paragraphs are supplied, but there is no strong user-facing confirmation or safeguard. In a document-editing skill this creates a real integrity risk: a partial or mistaken replacement JSON can silently erase large portions of presentation content.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 482)May include surrounding context.

md

- **playwright**: `npm install -g playwright` (for HTML rendering in html2pptx)
- **react-icons**: `npm install -g react-icons react react-dom` (for icons)
- **sharp**: `npm install -g sharp` (for SVG rasterization and image processing)
- **LibreOffice**: `sudo apt-get install libreoffice` (for PDF conversion)
- **Poppler**: `sudo apt-get install poppler-utils` (for pdftoppm to convert PDF to images)
- **defusedxml**: `pip install defusedxml` (for secure XML parsing)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 483)May include surrounding context.

md

- **playwright**: `npm install -g playwright` (for HTML rendering in html2pptx)
- **react-icons**: `npm install -g react-icons react react-dom` (for icons)
- **sharp**: `npm install -g sharp` (for SVG rasterization and image processing)
- **LibreOffice**: `sudo apt-get install libreoffice` (for PDF conversion)
- **Poppler**: `sudo apt-get install poppler-utils` (for pdftoppm to convert PDF to images)
- **defusedxml**: `pip install defusedxml` (for secure XML parsing)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

If soffice is missing, validate_document prints a warning and returns success, causing the tool to accept and emit files that were expected to be validated. This creates a fail-open integrity check: callers may rely on validation for safety or correctness, but malformed or intentionally crafted Office content will still be packaged and treated as valid.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · ooxml/scripts/pack.py (reported line 103)May include surrounding context.

python

with tempfile.TemporaryDirectory() as temp_dir:
        try:
            result = subprocess.run(
                [
                    "soffice",
                    "--headless",

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill manifest describes creating, editing, and analyzing presentation files, but this helper script executes the external soffice program to validate output. Spawning a subprocess is a materially broader capability than ordinary OOXML file manipulation and is not declared in the skill purpose as an expected behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The module docstring explicitly states that it unpacks Office files across .docx, .pptx, and .xlsx formats, while the skill manifest describes a presentation skill centered on .pptx creation, editing, and analysis. Supporting Word and Excel document extraction is broader than the presentation-specific behavior the skill claims.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script performs unrestricted ZIP extraction with zipfile.ZipFile(input_file).extractall(output_path) on user-supplied Office files. This is dangerous because crafted archives can exploit path traversal during extraction (zip slip) or write unexpected files into the filesystem, which is especially risky in an agent skill that may process untrusted documents automatically.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This code performs a bulk file write operation by extracting the Office archive into the user-supplied output directory. Although the module docstring mentions unpacking, there is no inline confirmation, print/log disclosure, or warning near the extraction step about creating files on disk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script rewrites every discovered XML and .rels file with pretty-printed output, which modifies extracted contents on disk. There is no confirmation prompt, print/log statement, or inline disclosure explaining that existing extracted files will be overwritten as part of formatting.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This module adds a capability to unpack, parse, and validate .docx/Word XML content, including tracked-change and paragraph-count analysis. That capability is not justified by the stated purpose of working with presentations and layouts in .pptx files, and it meaningfully expands the skill's content-handling domain beyond presentations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest describes a skill for creating, editing, and analyzing PowerPoint presentations (.pptx files), but this file implements validation logic for WordprocessingML/DOCX documents, including Word namespaces, document.xml parsing, and DOCX paragraph/change-tracking checks. Supporting Word document schema validation is a different document domain than presentation handling and is not an obvious implementation detail of PPTX processing.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.