T09 · Insecure Skill Coding Practices
Error
- Location
scripts/fix_pptx_compatibility.py:170- Finding
Unsafe In-Place Archive Overwrite Can Destroy the Input Presentation
- Content
View full analysis
- Remediation
View remediation
Security audit
PPT生成兼容性修复
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent PowerPoint repair helper, but its default repair script can overwrite and corrupt the user's original PPTX file without a safe backup path.
Use this skill only for pptxgenjs-generated PPTX files. Always pass a separate output filename, keep a backup of the original presentation, and review the generated file before replacing the source. Be cautious if it activates for generic PowerPoint tasks unrelated to pptxgenjs.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger condition is broad enough to activate on generic mentions of "PPT" generation, which can cause this skill to be invoked outside its intended pptxgenjs-specific context. Over-broad invocation increases the chance that unrelated tasks inherit mandatory post-processing guidance or file-modifying instructions that are unnecessary or unsafe for the actual workflow.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill instructs users to run a mandatory fix script and notes that it may overwrite the input file, but it does not prominently frame this as a potentially destructive file modification requiring backup or explicit consent. In an agent context, that omission can lead to silent alteration of user artifacts, data loss, or corruption if the script is misapplied to the wrong file or an unexpected output path.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file title and all instructional content are written entirely in Chinese, and there is no indication that users may choose another language or that the skill is intended only for a Chinese-speaking or region-specific audience. This creates a natural-language locale constraint without opt-in, which matches the policy's language/locale violation criterion.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This code file performs a safety-relevant file write that can replace the user's original document when no output path is supplied. Although the docstring notes that the input will be overwritten, the executable path contains no confirmation or stronger warning before the destructive operation occurs.
- Content
Static analysis
No suspicious patterns detected.