ClawHub
Back to skill

Security audit

YouMind PPT

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent PPT-generation workflow with disclosed local tooling, but users should be aware it may install unpinned packages and has a narrow unsafe cleanup command.

Install only if you are comfortable with the agent creating local presentation files, using image-generation tools, and potentially installing npm or pip packages. Run it in a project or temporary directory without unrelated slide-*.jpg files, and prefer preinstalled or pinned dependencies where possible.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:226
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 226-229
Vulnerability Type: Supply-chain exposure through unpinned package installation
Risk Level: Medium

Vulnerable Code

markdown
- **pptx skill** (used for final PPTX generation) — If a pptx skill exists in the environment, first read its SKILL.md to understand the PptxGenJS API; otherwise, use `npm install pptxgenjs` and then directly write a Node.js script to generate it
- **Image generation tool** (DALL-E / another available image-generation MCP) — If image generation is unavailable, organize the prompts into a document for the user to generate independently
- `pip install "markitdown[pptx]"` — used for content validation
- `npm install pptxgenjs` — used for PPTX creation

Technical Analysis

The skill instructs the agent to install pptxgenjs and markitdown[pptx] dynamically without specifying reviewed versions, lockfiles, package hashes, trusted registry configuration, or an approval boundary. Consequently, the effective dependency code may change after the skill itself has been audited.

Package installation can execute dependency installation or build logic under the privileges of the process running the agent. This creates a supply-chain risk if an upstream package or transitive dependency is compromised, if registry resolution is redirected, or if a later release introduces malicious behavior.

The finding does not establish that either named package is malicious. The vulnerability is the unsafe, non-reproducible dependency acquisition process.

Attack Path

  1. A user invokes the skill in an environment where the required dependency is unavailable.
  2. The agent follows the instruction to execute npm install pptxgenjs or pip install "markitdown[pptx]".
  3. The package manager resolves the latest matching release and its transitive dependencies from the configured registry.
  4. An attacker who has compromised an upstream ...[truncated 811 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin each direct dependency to a reviewed, exact version rather than resolving the latest release.
  • Commit and enforce package-manager lockfiles with integrity metadata.
  • For Python dependencies, use a requirements file containing hashes and install with hash verification.
  • Configure package managers to use an approved registry and reject unexpected registry overrides.
  • Run dependency installation and document generation in an isolated, least-privileged environment without unnecessary secrets.
  • Disable npm lifecycle scripts where compatible with the reviewed dependency.
  • Require explicit user approval before modifying the environment or downloading packages.
  • Scan direct and transitive dependencies and periodically review pinned-version updates.

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:199
Finding

Broad Wildcard Deletion During Visual Validation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 199-203
Vulnerability Type: Unsafe file cleanup using a working-directory wildcard
Risk Level: Low

Vulnerable Code

bash
libreoffice --headless --convert-to pdf output.pptx
rm -f slide-*.jpg
pdftoppm -jpeg -r 150 output.pdf slide
markdown
If LibreOffice is unavailable, skip visual validation and provide the file directly to the user for manual review.

Technical Analysis

The cleanup command deletes every file matching slide-*.jpg in the process's current working directory. It does not establish a dedicated run-specific output directory, enumerate exact artifacts created by the current invocation, or verify that matching files are disposable.

Shell wildcard expansion occurs before rm runs. Therefore, unrelated user files such as slide-cover.jpg or slide-archive.jpg can be included in the deletion set. The -f option suppresses confirmation and missing-file errors, making accidental loss less visible.

The command does not interpolate user-controlled data and therefore does not demonstrate command injection. The confirmed issue is overbroad destructive file handling.

Attack Path

  1. The skill is run with its current working directory set to a directory containing pre-existing files whose names match slide-*.jpg.
  2. The visual-validation workflow reaches the cleanup step.
  3. The shell expands slide-*.jpg to all matching paths in that directory.
  4. rm -f deletes those files without confirmation.
  5. pdftoppm then creates the current run's slide images, but the unrelated pre-existing files have already been removed.

Impact Assessment

Exploitation or accidental triggering can cause irreversible deletion of matching files writable by the agent account in the current directory. The impact is confined to files matching the wildcard and to locations accessible under the process's permissions.

This iss ...[truncated 202 chars]

Remediation
View remediation

Remediation Suggestions

  • Create a unique temporary directory for every validation run and place all generated PDF and image artifacts inside it.
  • Use absolute, validated paths rather than relying on the process's current working directory.
  • Remove only the unique temporary directory after confirming it is inside an approved workspace.
  • If individual cleanup is necessary, record exact generated filenames and delete only those paths.
  • Avoid broad wildcard deletion and add path-containment checks before any destructive operation.
  • Preserve or back up pre-existing files when an output path collision is detected.

A safer pattern is:

bash
workdir="$(mktemp -d)"
libreoffice --headless --convert-to pdf --outdir "$workdir" output.pptx
pdftoppm -jpeg -r 150 "$workdir/output.pdf" "$workdir/slide"
# Review generated files, then remove only the verified temporary directory.
rm -rf -- "$workdir"

The implementation should additionally verify that workdir is non-empty and located under the expected temporary root before recursive removal.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest description says the skill must trigger not only for specific phrases like 'YouMind 风格 PPT' but also for broader requests such as '插画风 PPT', '故事化 PPT', and '我要一个像信息图一样的 PPT'. These are common ways to ask for a stylized deck and are not narrowly scoped to this specific skill, which increases the risk of unintended invocation over other PPT-related skills.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill instructs the agent to install packages and run multiple local CLI tools such as pip, npm, LibreOffice, pdftoppm, and markitdown. In a skill context, this expands the execution surface beyond core business logic and can cause unreviewed code execution, dependency supply-chain exposure, and filesystem/process interaction on the host.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Line L003 states that all prompts are in English for best generation results, which imposes a language preference as a blanket requirement. Under the policy, forcing a specific language without user opt-in or a clearly justified regional/compliance need is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The file is entirely written as a mandatory guidance document in Chinese and states that page-structure selection in stage 2 should reference this file. There is no indication that language is optional, selectable by the user, or justified as a region-specific requirement, which can violate language/locale policy constraints.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instruction requires that custom character descriptions be normalized into an English phrase, regardless of the user's language preference. This imposes a specific language choice without offering opt-in or documenting why English is required.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

Lines L43-L46 instruct that custom role information must be organized into a standard English description, even though the surrounding document is written in Chinese. This creates a language-policy concern because the skill imposes an output language without documenting user choice or justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.