Security audit

Digital Finance Presentation Skill

Security checks across malware telemetry and agentic risk

Overview

This is a real Keynote presentation automation skill, but it gives an agent broad persistent control over local Keynote documents without enough guardrails.

Review carefully before installing. Use it only on macOS systems where you are comfortable letting an agent control Keynote, and work on copies of decks. Avoid confidential presentations unless your assistant environment is approved for that data, and manually inspect the Claude Desktop MCP config change and Python dependency installation before running the installer.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (22)

subprocess module call

Medium

Category: Dangerous Code Execution
Content: ) # 用 osascript 命令执行 proc = subprocess.run( ["osascript", "-e", script], capture_output=True, text=True,
Confidence: 98% confidence
Finding: This function executes arbitrary AppleScript supplied as a string via osascript with no allowlist, sandboxing, or meaningful validation. In a presentation-generation skill, that is dangerous because AppleScript can automate other macOS apps, access files, and trigger privileged user-approved actions far beyond simple slide creation.

subprocess module call

Medium

Category: Dangerous Code Execution
Content: "。Keynote 自动化仅在 macOS 上可用。" ) proc = subprocess.run( ["osascript", "-l", "JavaScript", "-e", script], capture_output=True, text=True,
Confidence: 98% confidence
Finding: This function executes arbitrary JXA code through osascript, which gives the caller broad macOS automation capability similar to AppleScript, plus JavaScript-based access patterns that can invoke system automation features. That exceeds the stated presentation purpose and creates a powerful code-execution primitive inside the skill.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The installer modifies Claude Desktop's host configuration by creating or editing claude_desktop_config.json to register a local MCP server. Even if this is part of setup, it exceeds simple presentation generation and changes persistent user application state, which can expand the skill's capabilities and trust boundary without explicit approval.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The script performs network package installation with pip install --upgrade pip and pip install "mcp[cli]", introducing remote code and supply-chain risk at install time. For a skill presented as a presentation generator, this capability is broader than the stated end-user function and can execute unpinned third-party code on the host.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The test routine actively invokes osascript and tells Keynote to activate, demonstrating the ability to control local macOS applications through AppleScript. In the skill context, presentation generation does relate to Keynote, but automatically exercising desktop automation from an installer materially increases local execution and privacy risk.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The module provides a generic AppleScript execution capability rather than only presentation-specific automation. In skill context, this makes the skill materially more dangerous because any downstream agent or prompt-controlled input can transform a slideshow tool into a general local automation mechanism.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The screen information helper embeds a shell command inside AppleScript using do shell script and system_profiler. While not directly taking user input, it adds an unnecessary shell-execution capability to a presentation generator, increasing attack surface and normalizing broader system interrogation beyond the tool's stated purpose.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The skill metadata frames this as an SAP enterprise presentation generator, but the server exposes a large set of general-purpose Keynote control functions including opening arbitrary files, editing active documents, exporting content, presentation control, and environment inspection. This scope expansion increases the attack surface and enables an AI agent to manipulate local documents and application state beyond the user's likely expectation for a narrowly scoped report-generation skill.

Context-Inappropriate Capability

Low

Confidence: 84% confidence
Finding: The screen inspection and auto-fit features collect local display characteristics that are not necessary for basic SAP presentation generation and can reveal host-environment details to an agent. While low severity on their own, they broaden local reconnaissance capabilities and may help fingerprint the system or adapt malicious behavior to the environment.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The script behavior materially differs from the advertised skill purpose: instead of a general SAP enterprise presentation generator, it creates a fixed single-company valuation deck. This kind of scope mismatch is dangerous because it can conceal unexpected capabilities or content generation behavior from users and reviewers, undermining trust and informed consent.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The script performs macOS-specific AppleScript automation of Keynote and writes a local file, which is a stronger local capability than the manifest suggests. Undisclosed local application control is risky because it can trigger privileged GUI automation and modify user files in ways the user did not reasonably expect from the skill description.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README advertises operations that can modify, delete, save, close, and export documents, but it does not warn users about irreversible changes, overwrites, or data loss. In an AI-operated automation context, omission of such warnings is dangerous because the assistant may perform destructive actions on user files without the user understanding the consequences.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The example prompt encourages opening and analyzing a local Keynote file without warning that the assistant may read slide contents and expose sensitive business information to the AI or connected tooling. This is particularly risky in an enterprise presentation skill, where documents may contain confidential financial, strategic, or customer data.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill explicitly advertises capabilities to create, open, save, export, delete, and rearrange presentation content, but it does not warn users that these operations can modify existing Keynote documents or overwrite files on disk. In an MCP/agent context, this is dangerous because an AI may invoke destructive file-manipulation actions on behalf of a user without clear confirmation boundaries, leading to unintended data loss or artifact generation.

Missing User Warnings

Low

Confidence: 86% confidence
Finding: The documented presenter mode, autoplay, timer, printing, and export features can change application state, start presentations, and generate external files, yet the skill does not communicate these side effects or recommend user confirmation. In a desktop automation setting, this can cause surprise behavior such as launching fullscreen presentations, printing notes, or leaving files behind without the user's informed consent.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The installer writes the modified Claude Desktop configuration back to disk without prompting for consent immediately before the change. Although it creates a backup, silent overwrite of user configuration can break existing setups or persist unwanted execution behavior by registering a new MCP server.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: Arbitrary AppleScript execution is exposed without any user-facing warning, consent gate, or trust boundary enforcement. In an agent skill, hidden automation execution is especially risky because a model or caller may pass attacker-influenced script text that performs unintended local actions under the user's account.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The JXA executor similarly allows silent execution of arbitrary automation code with no warning or boundary checks. Because JXA can reach system automation interfaces, this creates a strong local-execution primitive inconsistent with a narrowly scoped presentation skill.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The delete_slide function performs an irreversible content-destructive action immediately, with no confirmation, dry-run, or guardrails. In an agentic context, a mistaken instruction, prompt injection, or model misunderstanding could silently remove user content from the active presentation.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: save_presentation writes to disk, including arbitrary user-supplied paths via save_document_as, without any user-facing confirmation about filesystem modification or overwrite risk. In an MCP/agent setting, this can cause unintended persistence of generated or modified content to sensitive or surprising locations.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: export_document writes output files in multiple formats to user-provided paths without warning, overwrite checks, or path restrictions. This creates a straightforward avenue for unintended file creation/replacement and data exfiltration-by-export if an agent is induced to export sensitive presentation contents.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The script saves a `.key` file directly to the user's Desktop without prior confirmation. While not a severe security flaw by itself, unexpected file creation on a common user-visible path can be intrusive and becomes more concerning in a skill whose manifest does not clearly disclose this behavior.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.