Security audit

Ppt Generator

Security checks for vulnerabilities and agentic risk

Overview

This PPT-generation skill is mostly purpose-aligned, but it should be reviewed because it mandates web research on user topics and recommends broad unpinned dependency installs without clear consent or isolation.

Install only if you are comfortable with the agent using web search for incomplete presentation topics and installing external packages. Avoid using confidential project names, customer names, unreleased plans, health, financial, or personal data unless you explicitly keep the work local and approve any searches or installs first. Prefer local, pinned, sandboxed dependencies instead of global npm, broad pip extras, or Homebrew installs.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

other

Warning

Location: SKILL.md:27
Finding: Mandatory External Research Can Disclose User-Derived Sensitive Information
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 27-46
Vulnerability Type: Privacy exposure through unnecessary network transmission
Risk Level: Medium

Relevant instruction excerpt translated into English:

markdown
If the user's input is limited or incomplete, the AI must proactively search the Internet to supplement the content. After receiving a short topic, immediately perform the following operations: 1. Identify content gaps - Did the user provide only a topic? Search for detailed content. - Did the user provide only a title? Add body points. - Is the description vague? Clarify the industry, scenario, and audience. 2. Internet research Use web_search or web_fetch to retrieve: - Market data, trends, and cases for the relevant industry - Popular opinions, expert advice, and industry insights - Real cases, statistics, and user pain points - Current topics, current events, and industry terminology

Technical Analysis

The Skill makes external research mandatory when it considers user input incomplete. Search requests are derived from the user's topic, industry, scenario, and intended audience. These values may contain confidential project names, unreleased products, internal business plans, medical topics, financial information, or other sensitive context.

Sending derived queries through web_search or URLs through web_fetch transfers information outside the local execution environment. The Skill does not require explicit consent, classify the sensitivity of the topic, redact identifying information, restrict requests to approved domains, or offer an offline-only workflow.

External research can be useful for creating a presentation, but it is not necessary when the user wants a presentation based exclusively on supplied material. Requiring it in all sparse-input cases therefore exceeds the minimum network privileges needed for the declared PPT-generation functionality.

...[truncated 1245 chars]
Remediation: View remediation
Remediation Suggestions

Make Internet research optional rather than mandatory.

Obtain explicit user approval before transmitting user-derived search terms.

Provide an offline mode that uses only content supplied by the user.

Add sensitivity checks for internal names, personal data, health information, financial information, credentials, and unreleased products.

Redact or generalize sensitive identifiers before constructing queries.

Restrict web_fetch to approved HTTPS domains and reject private, loopback, link-local, and cloud-metadata addresses.

Show the proposed query or destination to the user before network access where confidential material may be involved.

Minimize request and response logging and document the privacy policies of external providers.

Preserve source citations and distinguish verified data from model-generated assumptions.

T08 · Insecure Dependencies

Warning

Location: SKILL.md:407
Finding: Unpinned Global and System-Level Third-Party Dependency Installation
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 407-413
Vulnerability Type: Unsafe and overprivileged dependency installation
Risk Level: Medium

Complete dependency installation segment translated into English while preserving the commands:

bash
# Node.js dependency npm install -g pptxgenjs # Python dependencies used for preview generation pip install "markitdown[pptx]" Pillow # LibreOffice used for image conversion brew install libreoffice # macOS

A duplicate global npm installation instruction also appears at line 190:

bash
npm install -g pptxgenjs

Technical Analysis

The instructions install dependencies without fixed versions, integrity hashes, or a lockfile. Package managers will therefore resolve mutable current releases and their transitive dependency trees at installation time. The audited content cannot guarantee that the downloaded components are the same versions that were reviewed.

npm install -g installs a package globally instead of confining it to the project. Depending on the host configuration, global installation may require elevated permissions and can affect other projects or users. Python extras can introduce a broader transitive dependency set, while Homebrew installs a large system application that is unnecessary for presentation generation when preview conversion is not requested.

Package installation can execute package lifecycle logic or otherwise place executable content on the host. Although no specific listed package was shown to be malicious, the absence of pinning, integrity controls, isolation, and approval creates supply-chain exposure and exceeds least privilege for a documentation-only Skill.

Attack Path

An agent follows the dependency installation instructions during Skill use.

The package manager contacts an external registry and resolves the latest available package and transitive dependency versions.

A compr ...[truncated 1118 chars]
Remediation: View remediation
Remediation Suggestions

Pin reviewed package versions instead of resolving mutable latest releases.

Use lockfiles and integrity hashes for npm and Python dependencies.

Install npm packages locally in the project rather than using npm install -g.

Use an isolated virtual environment for Python dependencies.

Run generation and conversion inside a restricted container or sandbox with minimal filesystem and network access.

Restrict package downloads to approved registries and enable provenance or signature verification where supported.

Require explicit user approval before installing any package.

Separate optional preview tooling from core PPT generation so LibreOffice is installed only when conversion is requested.

Document tested versions and periodically scan direct and transitive dependencies for known vulnerabilities.

Avoid invoking package managers with administrative privileges.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list includes broad natural-language phrases such as '帮我做个PPT' and 'create presentation', which can plausibly appear in ordinary conversation and cause unintended skill activation. In an agentic context, accidental activation matters because this skill is designed to initiate follow-up questioning and potentially automatic web searches, increasing the chance of unwanted data handling or external requests.
Content: No source excerpt is available for this finding.

Missing User Warnings