Security audit
Security checks for vulnerabilities and agentic risk
This skill coherently generates PowerPoint files through Baidu's AI service using a declared Baidu API key, but users should avoid sending confidential content.
Install only if you are comfortable using Baidu's remote AI PPT service with your Baidu API key. Do not submit secrets, regulated data, private business plans, or personal information unless that use is acceptable under your organization's policies and Baidu's terms.
Claiming intelligent content analysis while actually relying on keyword heuristics and random template choice is a misleading behavior mismatch, especially when combined with undeclared external access using an API key. The main risk is user deception and unanticipated transfer of input content to an external service without clear permission boundaries.
Claiming intelligent content analysis while actually relying on keyword heuristics and random template choice is a misleading behavior mismatch, especially when combined with undeclared external access using an API key. The main risk is user deception and unanticipated transfer of input content to an external service without clear permission boundaries.
Claiming intelligent content analysis while actually relying on keyword heuristics and random template choice is a misleading behavior mismatch, especially when combined with undeclared external access using an API key. The main risk is user deception and unanticipated transfer of input content to an external service without clear permission boundaries.
The skill declares access to environment variables and implicitly requires shell/networked script execution, but it does not declare an explicit tool scope such as allowed-tools or permissions. This weakens containment and reviewability because an agent may execute scripts with broader capabilities than a user would reasonably expect, especially when an API key and outbound requests are involved.
The skill asks users for a PPT topic and then sends that content to Baidu's AI service, but the description does not warn users about this outbound data transfer. This creates a privacy and compliance risk because users may provide confidential business, educational, or personal content believing it will be processed only within the local agent environment.
The script sends user-supplied query content to an external Baidu endpoint to generate a PPT outline. This is an actual data egress behavior: any sensitive information placed in the prompt will be transmitted to a third party, which matters because the skill description does not explicitly warn that user content is sent off-platform.
outline = ""
chat_id = ""
query_id = ""
with requests.post(URL_PREFIX + "generate_outline", headers=headers, json=params, stream=True) as response:
for line in response.iter_lines():
line = line.decode('utf-8')
if line and line.startswith("data:"):
The script sends the generated outline, title, query, and optional web_content to an external Baidu endpoint for PPT generation. If web_content or the query includes proprietary, personal, or confidential material, the skill will transmit that data to a third-party service, creating a genuine confidentiality risk in the context of an agent skill.
"web_content": web_content,
"enable_save_bos": True,
}
with requests.post(URL_PREFIX + "generate_ppt_by_outline", headers=headers, json=params, stream=True) as response:
if response.status_code != 200:
print(f"request failed, status code is {response.status_code}, error message is {response.text}")
return []
This code hard-codes category labels, keyword matching, and CLI help text in Chinese, and the theme suggestion logic depends on Chinese-language query terms for correct behavior. Because the skill does not offer a language/locale option or explicitly justify that it is intended only for a Chinese-language environment, it creates a natural-language policy issue by forcing a specific locale implicitly.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
]
start_time = int(time.time())
process = subprocess.Popen(
cmd,
stdout=subprocess.PIPE,
stderr=subprocess.PIPE,
The skill references use of BAIDU_API_KEY and an external dependency but does not clearly warn users that operation depends on third-party credentials and remote service availability. While not an exploit by itself, this omission reduces informed consent and can lead to accidental credential misuse or misunderstanding about reliability and trust boundaries.
The manifest describes a PPT-generation capability, but does not mention handling credentials or accessing environment state. Reading BAIDU_API_KEY is not part of the user-visible document-generation purpose and introduces a capability to access local runtime secrets.