Security audit

Tech Report PPT Generator

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a PPT/report generator, but its URL fetching and session-file handling lack safeguards that could write outside its report folder or reach internal network resources.

Review this skill before installing. Run it only in an isolated workspace with limited filesystem and network access, use simple alphanumeric session IDs, pin dependencies, and avoid allowing untrusted search results or URLs to drive downloads.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: lib/config.js:125
Finding: Unvalidated session identifiers allow filesystem path traversal
Content: View full analysis
ensureDir(dir)); return dirs; } ``` The logger also writes to a path derived from the same identifier: ```javascript constructor(sessionId) { this.sessionId = sessionId; this.logFile = path.join(config.getSessionDir(sessionId), 'run.log'); this.steps = []; } log(level, message) { const timestamp = new Date().toISOString(); const line = `[${timestamp}] [${level}] ${message}`; console.log(line); if (this.logFile) { fs.appendFileSync(this.logFile, line + '\n'); } } ``` ### Technical Analysis The command-line `--session-id` value is used directly in a path without a character allowlist, canonicalization, or containment validation. Because the fixed `insight_` prefix does not remove embedded path separators or `..` components, an identifier such ...[truncated 1429 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/02_extract_insights.js:294
Finding: Mutable session metadata permits reads outside the selected session
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/01_search_and_collect.js:80
Finding: Unrestricted URL retrieval enables server-side request forgery
Content: View full analysis
{ const file = fs.createWriteStream(destPath); const protocol = url.startsWith('https') ? https : http; protocol.get(url, (response) => { if (response.statusCode === 301 || response.statusCode === 302) { const redirectUrl = response.headers.location; file.close(); downloadFile(redirectUrl, destPath).then(resolve).catch(reject); return; } if (response.statusCode !== 200) { file.close(); reject(new Error(`HTTP ${response.statusCode}`)); return; } response.pipe(file); file.on('finish', () => { file.close(); resolve(true); }); }).on('error', (err) => { file.close(); fs.unlink(destPath, () => {}); reject(err); }); }); } ``` A caller-controlled result can trigger the request: ```javascript if (item.isPaper && result.pdfUrl) { const fileName = `${String(item.id).padStart(3, '0')}_${fileUtils.safeFileName(item.title)}.pdf`; const filePath = path.join(dirs.papers, fileName); try { await downloadFile(result.pdfUrl, filePath); item.paperFile = filePath; item.paperSize = fileUtils.getFileSize(filePath); } catch (err) { log.warn(` ⚠️ 论文下载失败: ${err.message}`); } } ``` The text extraction helper has the same trust issue: ```javascript async function extractTextFromUrl(url) { return new Promise((resolve, reject) => { const protocol = url.startsWith('https') ? https : http; protocol.get(url, (response) => { if (response.statusCode === 301 || response.statusCode === 302) { ext ...[truncated 2029 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/01_search_and_collect.js:80
Finding: Unbounded network responses can exhaust memory, disk, or execution time
Content: View full analysis
{ const file = fs.createWriteStream(destPath); const protocol = url.startsWith('https') ? https : http; protocol.get(url, (response) => { if (response.statusCode === 301 || response.statusCode === 302) { const redirectUrl = response.headers.location; file.close(); downloadFile(redirectUrl, destPath).then(resolve).catch(reject); return; } if (response.statusCode !== 200) { file.close(); reject(new Error(`HTTP ${response.statusCode}`)); return; } response.pipe(file); file.on('finish', () => { file.close(); resolve(true); }); }).on('error', (err) => { file.close(); fs.unlink(destPath, () => {}); reject(err); }); }); } ``` ```javascript async function extractTextFromUrl(url) { return new Promise((resolve, reject) => { const protocol = url.startsWith('https') ? https : http; protocol.get(url, (response) => { if (response.statusCode === 301 || response.statusCode === 302) { extractTextFromUrl(response.headers.location).then(resolve).catch(reject); return; } let data = ''; response.on('data', chunk => data += chunk); response.on('end', () => resolve(data)); }).on('error', reject); }); } ``` ### Technical Analysis The downloader streams an unlimited response directly to disk. The text extractor concatenates the complete response into one in-memory string. Neither implementation establishes a connection timeout, inactivity timeout, total duration limit, maximum response size, or maximum redirect count. An attacker-c ...[truncated 1315 chars]
Remediation: View remediation
{ received += chunk.length; if (received > MAX_BYTES) { response.destroy(new Error('Response too large')); } }); ``` 3. Reject responses whose declared `Content-Length` exceeds the configured limit. 4. Stream text processing instead of concatenating an unlimited response in memory. 5. Limit redirects to a small number, such as three to five. 6. Clean up partial files for every unsuccessful completion path. 7. Limit concurrent downloads and apply per-session disk quotas. 8. Validate expected content types and use a conservative maximum PDF size. ]]>

T08 · Insecure Dependencies

Warning

Location: README.md:8
Finding: Third-party dependencies are installed without version or integrity pinning
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (19)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 声明描述强调“AI 驱动的技术洞察 PPT 生成器”，其核心能力应围绕内容分析、PPT 生成或相关流程展开。而提供的代码块仅表现为底层文件操作与会话目录管理工具，没有体现 AI 分析、技术洞察生成、幻灯片生成等主功能。虽然这类文件工具可能作为实现 PPT 生成器的辅助组件存在，但就该代码块本身而言，其实际行为与声明用途不一致，且包含明显的文件系统操作能力（包括递归删除目录），这些能力在声明中未体现。根据评估标准，这属于代码实际行为与声明目的存在明显偏离。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 声明的用途是一个“AI 驱动的技术洞察 PPT 生成器”，核心应与内容分析、PPT生成或相关工作流直接相关。但实际代码仅是一个日志工具模块，负责控制台输出、追加写入本地日志文件、记录步骤开始/完成/失败，以及生成和打印执行报告。虽然日志组件可作为大型PPT生成器的辅助模块，但就该代码片段本身而言，其实际行为与声明的主要功能并不相符；此外，代码还执行了未在声明权限中体现的文件系统写入操作。不过这属于辅助实现细节的一部分，真正的主要不匹配在于：该代码并不体现任何AI分析、技术洞察提取或PPT生成能力。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description says the skill is an AI-powered technical-insight PPT generator, which implies the primary function is producing presentation output. However, this code chunk is specifically a data acquisition stage: searching/collecting results, extracting webpage content, downloading papers, and persisting artifacts to disk. The comments and function names explicitly describe 'search + content extraction + document download,' and the exported/run behavior centers on collection statistics and session files. While such collection could support later PPT generation, this chunk’s actual behavior is materially different from the declared end-user purpose and includes undeclared capabilities involving network retrieval and local document storage.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The description claims the skill is a PPT generator for technical insights, but this code chunk only performs step 2 of a workflow: reading collected search/web content, organizing insight data structures, and writing JSON outputs (insights.json, key_stats.json, evidence.json). The actual LLM analysis is not implemented here beyond a placeholder, and there is no presentation or slide-generation behavior. While insight extraction could support a PPT generator overall, this specific code chunk’s primary purpose is materially different from the declared purpose.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The natural-language instructions throughout the README are written entirely in Chinese, including usage, parameters, troubleshooting, and descriptions. Under the policy, forcing a specific language without user opt-in or a documented region-specific justification is a language/locale policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description explicitly presents the skill as a Chinese-language PPT generator, and the rest of the document reinforces fixed Chinese output conventions rather than offering a language choice. This creates a locale/language policy issue because the skill appears to force a specific language experience without documented user opt-in or justification as a region-specific tool.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The title style section mandates Microsoft YaHei for titles, and later sections extend that requirement across all content, indicating a fixed locale-specific presentation standard. Because no user choice or region-specific justification is given, this is a natural-language locale policy violation rather than a mere formatting preference.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The topic value is written in Chinese, which indicates the skill is configured to operate in a specific language. For a config file, this can reflect a locale-specific behavior without any visible user choice or justification, which violates the policy against forcing a language or locale without opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This code exposes a recursive, forceful directory deletion operation via fs.rmSync with no confirmation prompt, logging, or other user-facing disclosure at the point of deletion. Although the function has an internal comment describing its purpose, there is no visible warning to users that invoking this helper can irreversibly remove directory contents.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code embeds Chinese output strings in the generated filename, presentation title, and slide headings, indicating the skill forces a specific language/locale. The file contains no visible user opt-in or configuration mechanism for language selection, which matches the locale policy violation criteria.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code materially exceeds the declared skill purpose of generating PPT insights by performing broad web search, arbitrary URL fetching, raw HTML/text extraction, and PDF downloading to local storage. This expands the skill into a general network-enabled collection agent, which increases data exfiltration, unsafe content ingestion, and misuse risk—especially because URLs and downloaded documents are not restricted to an allowlist or validated against the declared task scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This script's natural-language interface is entirely in Chinese, including the header usage documentation and operational descriptions. Because the file does not offer any user opt-in or alternative locale, it can be read as enforcing a specific language, which matches the language/locale policy violation category.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This code file contains natural-language documentation and CLI guidance in a single enforced language, including the file header, usage notes, and output descriptions. Under the stated policy, forcing a specific language without user opt-in is a locale-policy violation unless the restriction is clearly justified, which is not present here.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The implementation in run() scans slides, records issues, and saves the resulting report and slide copies, but it does not actually apply any optimizations in the main execution path. The final console message states '进行了 ... 处优化', which contradicts the documented and actual behavior that optimization is left for manual agent action in comments around L409-L413.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest describes an 'AI-driven technical insight PPT generator', which suggests generating insights from inputs or model-driven analysis. In this file, the content is fully hard-coded slide text and layout data, with no AI inference, no input processing, and no dynamic insight generation; it simply writes predetermined presentations to disk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The documentation is written entirely in Chinese, including headings, comments, and usage guidance, with no indication that other languages are supported or that the locale restriction is required for a region-specific purpose. Under the language/locale policy, this is a natural-language constraint that should either be optional or explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This code file contains natural-language comments and configuration context exclusively in Chinese, including the file description and section annotations, which may reflect a skill-level assumption of a fixed language. Under the policy rule, forcing a specific language without documented user choice can be a locale/language policy concern when no opt-in or justification is present.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The code hard-codes toLocaleDateString('zh-CN'), which enforces a specific language/locale in generated output. This is a natural-language policy concern because the skill does not offer locale selection or explain why Chinese formatting is required.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file's header comments and CLI usage are written only in Chinese, and the runtime console output throughout the script is also fixed in Chinese. This imposes a specific language on users without any opt-in or documented locale constraint, matching the language-policy violation criteria.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.