Security audit
Security checks for vulnerabilities and agentic risk
The skill is a presentation generator, but it can trigger on broad presentation requests and mandates external research plus deployment without clearly asking the user first.
Review this skill before installing if your presentation topics may include confidential business plans or client data. Use it only when you are comfortable with external research being performed, and require manual confirmation before any deployment or publication step.
The trigger phrases are broad enough to match ordinary requests about presentations, slides, or data visualization, causing unintended skill activation. In an agent setting, overbroad routing can make the system perform external research, generate large artifacts, or deploy outputs when the user did not clearly request this specific skill.
The skill instructs the agent to conduct external research and to deploy the completed presentation, but it does not require explicit user consent or warn that network access and publication may occur. In practice, this can lead to unintended disclosure of user prompts or sensitive business topics to external services and unintended publication of generated material.
The typography section hard-codes language handling by prescribing specific fonts for Chinese and English and a combined default font-family, but it does not state that the user can choose language or locale behavior. This creates an implicit language/locale policy constraint without opt-in or justification as a region-specific tool.
Earlier sections mandate SVG charts only, forbid decorative icons, and describe content slides as data-rich with no generated images. This subsection instead instructs that text slides should still add icons/shapes and explicitly includes mixed-media and image-showcase layouts, which conflicts with the rest of the skill's documented intent for consulting-style, chart-driven HTML slides.
Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
- [ ] 4+ content zones
- [ ] Footer with source citation
- [ ] Page number badge present
- [ ] **Text Overflow Check**: No text cut off at edges, no truncation with "..."
- [ ] **Whitespace Check**: No large empty gaps (>52px), 70%+ of content area filled, check right side and bottom
- [ ] **Accent Color Count**: ≤2 accent colors (excluding base colors)
- [ ] **Content Variety**: Not all bullet points — mix prose, tables, charts
The skill documentation repeatedly states that slides should use SVG charts only and that generated images are forbidden except in narrow cases, but this section says pie charts must be created with the image generation tool. That is an active contradiction in the documented implementation guidance, not merely an omission, and could cause the agent to violate the stated no-generated-images design intent.
Appendix B says backgrounds must be applied directly to .slide-content and explicitly warns against a full-size background div inside it. Appendix F later says slide backgrounds should use a real <img> element or a dedicated shape/div, which is the opposite implementation approach. These are mutually inconsistent instructions about how the generated HTML should represent slide backgrounds.
Appendix G states that all non-cover slides must use SVG for page number badges with text inside the SVG, yet the examples also present a plain <p> number-only badge as correct. This directly contradicts the stated mandatory implementation constraint and creates ambiguity about what the skill is actually intended to generate.
No suspicious patterns detected.