Ppt Afp

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:52 AM UTC
• Version: 1.1.0

Overview

This PPT skill has a coherent presentation-generation purpose, but it defaults to sending generated files to a fixed Feishu recipient and uses unsafe network execution settings.

Review before installing. Do not use this skill with confidential presentations unless Feishu sending is made opt-in, the recipient is confirmed each run, TLS verification is restored, and runtime tools are pinned or preinstalled from trusted sources.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

other

Error

• Location: SKILL.md:47
• Finding: Generated presentations are sent by default to a hard-coded Feishu recipient<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:47` and `SKILL.md:242-243` **Vulnerability Type**: Default external data disclosure to a fixed recipient **Risk Level**: High ### Vulnerable Code ```text | 是否发飞书 | 默认是 | ``` ```python # 见 TOOLS.md 中的飞书发文件脚本 # USER = ou_74c5a7816fcb78172bfca68a7f7449e8 ``` ### Technical Analysis The workflow enables Feishu delivery by default and specifies a fixed recipient identifier. The presentation may contain user-provided documents, business information, internal reports, or other confidential material. Sending the resulting file is not required to perform the core presentation-generation task. Default delivery to an embedded account therefore violates least-disclosure principles. The Skill does not require the user to provide or verify the destination recipient immediately before transmission. The actual Feishu delivery implementation is referenced through `TOOLS.md`, which is not part of the reviewed project. Consequently, recipient validation, authentication handling, upload security, and delivery confirmation safeguards could not be verified. ### Attack Path 1. A user supplies confidential content for conversion into a presentation. 2. The Skill generates images and packages the content into a PPTX file. 3. The Feishu delivery option remains enabled because its default value is “yes.” 4. The referenced sending process uses the embedded recipient identifier `ou_74c5a7816fcb78172bfca68a7f7449e8`. 5. The generated presentation is transmitted to that external account without the user explicitly selecting and confirming the recipient for the current run. ### Impact Assessment The fixed Feishu recipient can receive complete generated presentations and any sensitive information included in them. Potentially exposed data includes internal reports, strategy documents, financial information, personal data, unpublished material, and proprietary business content. This issue does not directly grant local sys ...[truncated 141 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Disable external delivery by default. - Require explicit, informed consent for every upload or message. - Ask the user to provide or select the Feishu recipient during the current run. - Display the resolved recipient name and identifier before transmission and require confirmation. - Remove the hard-coded recipient identifier from the Skill. - Separate presentation generation from external delivery so users can generate files without granting messaging permissions. - Restrict Feishu credentials to the minimum scopes needed for a single approved upload. - Add an audit record containing the confirmed recipient, file name, timestamp, and delivery result without recording presentation contents or secrets. - Include the referenced delivery script in the auditable project scope and validate its authentication, recipient-checking, and error-handling behavior. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:210
• Finding: TLS certificate verification is explicitly disabled for command execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:210-214` and `SKILL.md:229-233` **Vulnerability Type**: Disabled TLS certificate validation **Risk Level**: High ### Vulnerable Code ```bash cd {工作目录} && \ NODE_TLS_REJECT_UNAUTHORIZED=0 \ npx -y bun ~/.openclaw/skills/baoyu-image-gen/scripts/main.ts \ --batchfile batch.json --jobs 3 \ --provider google --model gemini-3-pro-image-preview ``` ```bash cd {工作目录} && \ NODE_TLS_REJECT_UNAUTHORIZED=0 \ npx -y bun ~/.openclaw/skills/baoyu-slide-deck/scripts/merge-to-pptx.ts . ``` ### Technical Analysis Setting `NODE_TLS_REJECT_UNAUTHORIZED=0` instructs Node.js processes to accept TLS certificates without validating their trust chain or hostname. The setting is inherited by the invoked `npx` and Bun-related process environment. This removes the authenticity guarantees normally provided by TLS. An attacker capable of intercepting network traffic can present a forged certificate without causing the connection to fail. The risk affects dependency retrieval through `npx` and any HTTPS communication performed by the invoked scripts. The first command processes presentation prompts through an external image-generation provider. The environment is also expected to contain `GEMINI_API_KEY` and `GOOGLE_BASE_URL`. Although the reviewed file does not explicitly transmit credentials to an unauthorized endpoint, disabled certificate verification materially weakens protection for network requests made by the process. ### Attack Path 1. An attacker obtains a network interception position, such as control of a proxy, DNS response, gateway, or untrusted wireless network. 2. The Skill starts a command with `NODE_TLS_REJECT_UNAUTHORIZED=0`. 3. The process initiates an HTTPS request for package resolution, API communication, or another remote resource. 4. The attacker presents a forged or otherwise untrusted TLS certificate. 5. The process accepts the certificate because verification is disabled. 6. The attacker c ...[truncated 828 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove `NODE_TLS_REJECT_UNAUTHORIZED=0` from both commands. - Deploy valid certificates whose hostname and trust chain can be verified normally. - If a private certificate authority is required, configure a narrowly scoped trusted CA bundle instead of globally disabling verification. - Validate `GOOGLE_BASE_URL` against an explicit allowlist of approved HTTPS endpoints. - Do not permit redirects from approved API endpoints to untrusted hosts. - Ensure package installation and API communication fail closed when certificate validation fails. - Avoid exposing unrelated secrets to these subprocesses; provide only the environment variables required for the specific operation. - Log certificate failures without logging API keys, authorization headers, prompts, or confidential presentation contents. ]]>

T08 · Insecure Dependencies

Error

• Location: SKILL.md:210
• Finding: Unpinned package execution through automatic npx installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:210-214` and `SKILL.md:229-233` **Vulnerability Type**: Unpinned executable dependency and automatic package execution **Risk Level**: High ### Vulnerable Code ```bash cd {工作目录} && \ NODE_TLS_REJECT_UNAUTHORIZED=0 \ npx -y bun ~/.openclaw/skills/baoyu-image-gen/scripts/main.ts \ --batchfile batch.json --jobs 3 \ --provider google --model gemini-3-pro-image-preview ``` ```bash cd {工作目录} && \ NODE_TLS_REJECT_UNAUTHORIZED=0 \ npx -y bun ~/.openclaw/skills/baoyu-slide-deck/scripts/merge-to-pptx.ts . ``` ### Technical Analysis The commands use `npx -y bun` without an exact version or integrity constraint. If the executable is not already available through trusted local resolution, `npx` may retrieve a package from its configured registry and execute it automatically. The `-y` option suppresses the interactive installation confirmation. Because no version is pinned, the effective executable can change after the Skill has been reviewed. A compromised registry account, malicious package release, dependency-resolution manipulation, or package-source compromise could therefore introduce attacker-controlled code. The supply-chain risk is aggravated by the simultaneous use of `NODE_TLS_REJECT_UNAUTHORIZED=0`, which weakens transport authentication during network activity. ### Attack Path 1. The Skill invokes `npx -y bun` on a system where the required executable is not already resolved from a trusted local installation. 2. `npx` queries its configured package source for the unpinned package. 3. The registry account, package release, package source, or network response supplies a malicious or compromised version. 4. The `-y` option permits installation without user review. 5. The retrieved package executes immediately under the Agent's operating-system account. 6. Malicious package code can access files, environment variables, network resources, and credentials available to that account. ### Impact ...[truncated 515 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Install Bun through a verified, approved distribution mechanism rather than retrieving it dynamically during each Skill run. - Pin Bun to an exact reviewed version. - Verify downloaded artifacts using trusted cryptographic signatures or published integrity hashes. - Use a dependency lockfile and a controlled internal registry or package mirror. - Remove `-y` so unexpected installation does not occur without review. - Prefer invoking an absolute path to a preinstalled, verified executable. - Restrict package lifecycle scripts where supported. - Run generation tools in a sandbox with limited filesystem, environment, and network access. - Remove `NODE_TLS_REJECT_UNAUTHORIZED=0` so registry transport retains certificate validation. - Establish a dependency-update process that requires security review before changing the pinned version. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (11)

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The trigger phrases are broad and match common user requests such as '帮我做PPT' or '生成幻灯片', which can cause the skill to activate in situations where the user did not intend this specific high-automation workflow. Because the skill can create files, call external AI services, and send content via Feishu, accidental invocation materially increases privacy and integrity risk.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Setting `NODE_TLS_REJECT_UNAUTHORIZED=0` disables certificate validation for the image-generation network call, making man-in-the-middle interception or service impersonation possible. In this workflow, prompts, content, and potentially credentials or generated assets could be exposed or modified in transit.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

NODE_TLS_REJECT_UNAUTHORIZED=0 \
npx -y bun ~/.openclaw/skills/baoyu-image-gen/scripts/main.ts \
  --batchfile batch.json --jobs 3 \
  --provider google --model gemini-3-pro-image-preview
```

**实时报告进度：** 每完成3张报告一次 "已完成 X/N 张"

• Confidence: 90% confidence
• Finding: The skill hardcodes use of an external provider/model (`google` / `gemini-3-pro-image-preview`) for content generation, which means user content is sent to a third party. While external model use is not inherently malicious, it is security-relevant here because it processes potentially sensitive slide content and is paired with insufficient disclosure and unsafe transport settings.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The PPT packaging command also disables TLS verification, introducing the same risk of intercepted or spoofed network interactions during execution. Even if packaging is mostly local, using an unsafe default in an execution command trains insecure practice and could expose downloads, dependency resolution, or any networked sub-operations the tool performs.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill uses an external image-generation provider and transmits prompts/content over the network, but it does not clearly warn the user that their data will leave the local environment. For a PPT workflow, users may supply proprietary business content, so hidden external transmission increases confidentiality risk.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill instructs the agent to rely on API credentials stored in `~/.zshrc`, which expands access to sensitive local secrets beyond what is clearly disclosed to the user. Even if intended for image generation, reading shell configuration increases exposure of unrelated credentials and normalizes secret access from a content-generation workflow.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

**执行命令：**
```bash
cd {工作目录} && \
NODE_TLS_REJECT_UNAUTHORIZED=0 \
npx -y bun ~/.openclaw/skills/baoyu-image-gen/scripts/main.ts \
  --batchfile batch.json --jobs 3 \
  --provider google --model gemini-3-pro-image-preview

• Confidence: 99% confidence
• Finding: `NODE_TLS_REJECT_UNAUTHORIZED=0` is an unsafe default that globally disables TLS certificate verification for the command, removing a fundamental network security control. In a workflow that contacts external services, this enables interception, data theft, and response tampering with little resistance.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence
• Finding: The skill invokes code through `npx -y bun` without pinning an exact package/version, which allows whatever is currently resolved by the package ecosystem to run at execution time. In a workflow that also handles local files and credentials, this creates a supply-chain risk where a compromised or changed upstream package could execute arbitrary code.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

**步骤1：用 merge-to-pptx.ts 打包**
```bash
cd {工作目录} && \
NODE_TLS_REJECT_UNAUTHORIZED=0 \
npx -y bun ~/.openclaw/skills/baoyu-slide-deck/scripts/merge-to-pptx.ts .
```

• Confidence: 99% confidence
• Finding: Using `NODE_TLS_REJECT_UNAUTHORIZED=0` in the packaging command repeats the same insecure default and can compromise any networked operation performed by the runtime or dependencies. Even where exploitation is indirect, disabling TLS verification meaningfully lowers the bar for adversaries on the network path.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence
• Finding: The packaging step again relies on `npx -y bun` without version pinning, so execution depends on mutable remote package state at runtime. Because this step runs locally during document generation and packaging, a malicious upstream update could lead to arbitrary code execution or tampering with generated output.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill sends generated files through Feishu by default without a clear upfront warning or explicit consent gate at the point of transmission. This can cause unintended disclosure of sensitive presentation content, especially when the user's material includes internal or confidential information.

Static analysis

No suspicious patterns detected.