T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/package_skill.py:62- Finding
Symbolic Link Following Can Expose Files Outside the Skill Directory
- Content
View full analysis
- Remediation
View remediation
Security audit
MS-PPT-Style: Morgan Stanley PPT Generator
Security checks for vulnerabilities and agentic risk
Overview
This skill is mostly a disclosed PowerPoint style generator, with some overclaimed chart support and a manual packaging utility that needs caution but no evidence of hidden execution or data exfiltration.
Install only if you want a Morgan Stanley-inspired PPT generator and are comfortable managing the pptxgenjs dependency. Treat the bundled packaging script as a developer utility: do not run it on untrusted skill folders, and review archive contents before sharing generated .skill files. Avoid using generated deck metadata or styling to imply official Morgan Stanley authorship unless you have permission.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The code substantially matches the declared purpose: it generates Morgan Stanley-style PPT presentations, includes bilingual content support, uses a gradient-like cover treatment, and implements metric cards plus pie, radar, and stacked bar charts. However, the description explicitly claims waterfall chart support, and no waterfall chart function exists in the exported API or code. Also, the description frames it as a skill for specific platforms, while the code is just a standalone pptxgenjs module with no platform-specific hooks or triggers. These are material description-to-behavior gaps, so this should be flagged as a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description says this skill generates professional financial-report-style PowerPoint presentations with specific chart and styling capabilities. The supplied code does none of that. It only creates a directory for a new skill, writes a generic markdown template, and makes subdirectories. This is a materially different primary purpose and behavior, so it is a clear mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description says this skill generates classic Morgan Stanley-style presentation decks with specific visual/charting capabilities. The supplied code does none of that. Its sole purpose is to validate a skill directory structure and package files into a .skill archive using zipfile. This is a materially different primary purpose and involves unrelated filesystem packaging behavior rather than presentation creation. Therefore, the description does not accurately represent the code.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description states the skill should be used for presentations "with bilingual content," which imposes a language requirement by default. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation unless the constraint is explicitly justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The phrase "所有页面中英对照" indicates that every page must contain Chinese-English parallel content. This is a language policy issue because it hard-codes bilingual output rather than allowing the user to choose their preferred language.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The feature list states '全双语内容: 所有页面中英对照', which indicates the skill always produces bilingual content. This is a natural-language locale policy constraint presented as mandatory behavior, with no opt-in or user choice described.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
The dependency uses a caret range (^3.12.0), which allows newer minor and patch releases to be installed over time. This can lead to non-reproducible builds and potential supply-chain exposure if an upstream release is compromised or introduces breaking or insecure behavior.
- Content
json "author": "QClaw", "license": "MIT", "dependencies": { "pptxgenjs": "^3.12.0" } }
Static analysis
No suspicious patterns detected.