Security audit

Ppt Afp

Security checks for vulnerabilities and agentic risk

Overview

This PPT skill has a coherent presentation-generation purpose, but it defaults to sending generated files to a fixed Feishu recipient and uses unsafe network execution settings.

Review before installing. Do not use this skill with confidential presentations unless Feishu sending is made opt-in, the recipient is confirmed each run, TLS verification is restored, and runtime tools are pinned or preinstalled from trusted sources.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

other

Error

Location: SKILL.md:47
Finding: Generated presentations are sent by default to a hard-coded Feishu recipient
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:210
Finding: TLS certificate verification is explicitly disabled for command execution
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:210
Finding: Unpinned package execution through automatic npx installation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (11)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger phrases are broad and match common user requests such as '帮我做PPT' or '生成幻灯片', which can cause the skill to activate in situations where the user did not intend this specific high-automation workflow. Because the skill can create files, call external AI services, and send content via Feishu, accidental invocation materially increases privacy and integrity risk.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Setting NODE_TLS_REJECT_UNAUTHORIZED=0 disables certificate validation for the image-generation network call, making man-in-the-middle interception or service impersonation possible. In this workflow, prompts, content, and potentially credentials or generated assets could be exposed or modified in transit.
Content: No source excerpt is available for this finding.

External Model or Provider Selection

High

Category: Excessive Agency
Confidence: 90% confidence
Finding: The skill hardcodes use of an external provider/model (google / gemini-3-pro-image-preview) for content generation, which means user content is sent to a third party. While external model use is not inherently malicious, it is security-relevant here because it processes potentially sensitive slide content and is paired with insufficient disclosure and unsafe transport settings.
Content: Scanner excerpt · SKILL.md (reported line 215)May include surrounding context.
NODE_TLS_REJECT_UNAUTHORIZED=0
npx -y bun ~/.openclaw/skills/baoyu-image-gen/scripts/main.ts
--batchfile batch.json --jobs 3
--provider google --model gemini-3-pro-image-preview

text
**实时报告进度：** 每完成3张报告一次 "已完成 X/N 张"

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The PPT packaging command also disables TLS verification, introducing the same risk of intercepted or spoofed network interactions during execution. Even if packaging is mostly local, using an unsafe default in an execution command trains insecure practice and could expose downloads, dependency resolution, or any networked sub-operations the tool performs.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill uses an external image-generation provider and transmits prompts/content over the network, but it does not clearly warn the user that their data will leave the local environment. For a PPT workflow, users may supply proprietary business content, so hidden external transmission increases confidentiality risk.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill instructs the agent to rely on API credentials stored in ~/.zshrc, which expands access to sensitive local secrets beyond what is clearly disclosed to the user. Even if intended for image generation, reading shell configuration increases exposure of unrelated credentials and normalizes secret access from a content-generation workflow.
Content: No source excerpt is available for this finding.

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 99% confidence
Finding: NODE_TLS_REJECT_UNAUTHORIZED=0 is an unsafe default that globally disables TLS certificate verification for the command, removing a fundamental network security control. In a workflow that contacts external services, this enables interception, data theft, and response tampering with little resistance.
Content: Scanner excerpt · SKILL.md (reported line 212)May include surrounding context.
执行命令：

bash
cd {工作目录} && \ NODE_TLS_REJECT_UNAUTHORIZED=0 \ npx -y bun ~/.openclaw/skills/baoyu-image-gen/scripts/main.ts \ --batchfile batch.json --jobs 3 \ --provider google --model gemini-3-pro-image-preview

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The skill invokes code through npx -y bun without pinning an exact package/version, which allows whatever is currently resolved by the package ecosystem to run at execution time. In a workflow that also handles local files and credentials, this creates a supply-chain risk where a compromised or changed upstream package could execute arbitrary code.
Content: No source excerpt is available for this finding.

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 99% confidence
Finding: Using NODE_TLS_REJECT_UNAUTHORIZED=0 in the packaging command repeats the same insecure default and can compromise any networked operation performed by the runtime or dependencies. Even where exploitation is indirect, disabling TLS verification meaningfully lowers the bar for adversaries on the network path.
Content: Scanner excerpt · SKILL.md (reported line 231)May include surrounding context.
步骤1：用 merge-to-pptx.ts 打包

bash
cd {工作目录} && \ NODE_TLS_REJECT_UNAUTHORIZED=0 \ npx -y bun ~/.openclaw/skills/baoyu-slide-deck/scripts/merge-to-pptx.ts .

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The packaging step again relies on npx -y bun without version pinning, so execution depends on mutable remote package state at runtime. Because this step runs locally during document generation and packaging, a malicious upstream update could lead to arbitrary code execution or tampering with generated output.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill sends generated files through Feishu by default without a clear upfront warning or explicit consent gate at the point of transmission. This can cause unintended disclosure of sensitive presentation content, especially when the user's material includes internal or confidential information.
Content: No source excerpt is available for this finding.