Security audit

academic-literature-ppt

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed academic-paper-to-Chinese-PPTX workflow with no executable code, install hooks, credentials, or hidden data access.

Install this when you specifically want academic literature converted into Chinese-language PPTX slides. If you need English, bilingual output, source-language preservation, or a different slide style, state that clearly before using it.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The skill description is framed broadly enough to trigger on many requests involving literature summaries or slide creation, which can cause the agent to invoke this skill in situations where the user did not explicitly ask for a PPTX literature-review workflow. Over-broad routing increases the chance of unintended behavior, including unnecessary file processing, unwanted translations, or output format mismatches.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The manifest states that the skill produces Chinese-translated slides as a default behavior without establishing user consent or preference. This can override user intent, create inaccurate or unwanted transformations of source material, and increase privacy/compliance risk if sensitive academic content is translated or reformatted unexpectedly.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: Declaring Chinese as the primary language in the reference/source specification bakes in a language transformation requirement that may not match the user's request or the source document's intended handling. In a skill that processes academic literature, this increases the risk of unauthorized or undesired translation and can degrade fidelity for technical content.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The workflow hard-codes translation to Chinese as a required step, making language conversion unavoidable even when the user only asked for summarization or slide creation. Mandatory translation can materially alter meaning in technical papers, introduce errors into citations or scientific claims, and cause the system to act beyond the user's authorized scope.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The contract hard-requires Chinese section names and presentation content without indicating this is optional or user-selectable. This can cause the skill to ignore the user's requested language or locale, producing outputs that are inaccessible, misleading, or noncompliant with user expectations in multilingual contexts.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The rule 'Translation only: Convert English text to Chinese' enforces a single output language regardless of user preference. In this skill, that creates a systematic prompt-quality and usability issue: the agent may override user intent, mishandle non-Chinese workflows, and reduce trust by silently forcing localization.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The contract hard-codes Chinese labels and bilingual/Chinese presentation conventions without any user language preference check. This can cause the agent to override requested output language, mis-handle audience expectations, and create unauthorized transformation of source material in ways that reduce reliability and user control.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: Requiring figure and table labels to be translated to Chinese forces modification of original scientific content without user approval. In an academic context, label translation can introduce terminology errors or mismatch with cited figures, which may misrepresent evidence and degrade trustworthiness of the generated slides.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.