Security audit
Security checks for vulnerabilities and agentic risk
The skill’s PPT-generation purpose is coherent, but its generator and setup workflow expose users to code-execution and unsafe system-level installation risks.
Install only after the maintainer removes the JavaScript injection path, enforces strict color validation, removes normal use of --skip-validation, and replaces the current dependency setup with pinned, local, non-privileged installs. Do not run the printed curl-to-sudo command or install global packages from this skill on a sensitive machine.
scripts/check_env.py:140Remote Installation Script Is Piped Directly into a Privileged Shell
scripts/generate_ppt.py:201Palette Values Permit JavaScript Injection and Arbitrary Node.js Code Execution
scripts/check_env.py:293Unpinned Dependencies Are Installed into Global or System-Managed Environments
The template-based generation path explicitly uses --skip-validation, bypassing the safety and sanitation step that was introduced to clean LLM-generated slide plans. Because the plan and template may both be influenced by untrusted user content, skipping validation can allow malformed or unsafe data to reach the generator, increasing the chance of file corruption, unsafe parser behavior, or unexpected script execution paths depending on downstream implementation.
--output presentation.pptx
--mode from-template
--template uploaded_template.pptx
--skip-validation
**Patch mode — modify specific slides without regenerating the full plan:**
Advertising --skip-validation as a supported generator option normalizes bypassing an important security control. Even if not the default, exposing this flag in skill documentation makes it easier for future prompts, operators, or automated flows to disable sanitization when handling untrusted LLM output or uploaded template/content files.
| `analyze_template.py` | Extract template design system | — |
| `suggest_style.py` | Infer style from content | `--lang`, `--slides` |
| `validator.py` | Sanitize LLM slide plan | `--out`, `--strict` |
| `generate_ppt.py` | Build PPTX (both modes) | `--mode`, `--template`, `--skip-validation`, `--patch` |
| `template_builder.py` | Fill template via python-pptx | `--template`, `--plan`, `--output` |
| `chart_builder.py` | chart dict → PptxGenJS chart code | (imported by generate_ppt.py) |
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
"note": "Python 3.9+ required",
},
"node": {
"linux": ["curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash -",
"sudo apt install -y nodejs",
"# or: sudo snap install node --classic"],
"macos": ["brew install node",
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Two modes:
--mode from-scratch PptxGenJS — builds a fresh styled presentation
--mode from-template template_builder.py — fills content into an uploaded .pptx template
(replaces the old "print instructions" stub)
v4 improvements:
- from-template mode now actually works via template_builder.py
Exposing a --skip-validation flag allows callers to bypass the only explicit safety gate before untrusted slide-plan data is turned into either executable JS or handed to template-processing logic. In this skill context, validation is security-relevant because the tool accepts arbitrary user-supplied content and can trigger downstream code execution or unsafe file processing.
parser.add_argument("--output", required=True, help="Output .pptx path")
parser.add_argument("--mode", choices=["from-scratch", "from-template"], default="from-scratch")
parser.add_argument("--template", help="Path to .pptx template (required for from-template mode)")
parser.add_argument("--skip-validation", action="store_true")
parser.add_argument("--patch", help='JSON string to patch specific slides, e.g. \'{"slides":[{"index":3,"title":"New Title"}]}\'')
args = parser.parse_args()
The skill clearly instructs the agent to read and write files and execute shell commands, but it declares no explicit tool scope or allowed-tools policy. That creates an over-privileged integration surface where the host may grant broader capabilities than necessary, increasing the blast radius if prompts, files, or downstream scripts are abused.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
⚠️ OPTIONAL — QA features will be unavailable:
▸ LibreOffice — Optional, needed for QA visual inspection
$ sudo apt install libreoffice # Ubuntu/Debian
$ brew install --cask libreoffice # macOS
▸ pdftoppm — Optional, needed for QA visual inspection
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
⚠️ OPTIONAL — QA features will be unavailable:
▸ LibreOffice — Optional, needed for QA visual inspection
$ sudo apt install libreoffice # Ubuntu/Debian
$ brew install --cask libreoffice # macOS
▸ pdftoppm — Optional, needed for QA visual inspection
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
⚠️ OPTIONAL — QA features will be unavailable:
▸ LibreOffice — Optional, needed for QA visual inspection
$ sudo apt install libreoffice # Ubuntu/Debian
$ brew install --cask libreoffice # macOS
▸ pdftoppm — Optional, needed for QA visual inspection
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
⚠️ OPTIONAL — QA features will be unavailable:
▸ LibreOffice — Optional, needed for QA visual inspection
$ sudo apt install libreoffice # Ubuntu/Debian
$ brew install --cask libreoffice # macOS
▸ pdftoppm — Optional, needed for QA visual inspection
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
⚠️ OPTIONAL — QA features will be unavailable:
▸ LibreOffice — Optional, needed for QA visual inspection
$ sudo apt install libreoffice # Ubuntu/Debian
$ brew install --cask libreoffice # macOS
▸ pdftoppm — Optional, needed for QA visual inspection
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
⚠️ OPTIONAL — QA features will be unavailable:
▸ LibreOffice — Optional, needed for QA visual inspection
$ sudo apt install libreoffice # Ubuntu/Debian
$ brew install --cask libreoffice # macOS
▸ pdftoppm — Optional, needed for QA visual inspection
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
⚠️ OPTIONAL — QA features will be unavailable:
▸ LibreOffice — Optional, needed for QA visual inspection
$ sudo apt install libreoffice # Ubuntu/Debian
$ brew install --cask libreoffice # macOS
▸ pdftoppm — Optional, needed for QA visual inspection
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
⚠️ OPTIONAL — QA features will be unavailable:
▸ LibreOffice — Optional, needed for QA visual inspection
$ sudo apt install libreoffice # Ubuntu/Debian
$ brew install --cask libreoffice # macOS
▸ pdftoppm — Optional, needed for QA visual inspection
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
⚠️ OPTIONAL — QA features will be unavailable:
▸ LibreOffice — Optional, needed for QA visual inspection
$ sudo apt install libreoffice # Ubuntu/Debian
$ brew install --cask libreoffice # macOS
▸ pdftoppm — Optional, needed for QA visual inspection
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
⚠️ OPTIONAL — QA features will be unavailable:
▸ LibreOffice — Optional, needed for QA visual inspection
$ sudo apt install libreoffice # Ubuntu/Debian
$ brew install --cask libreoffice # macOS
▸ pdftoppm — Optional, needed for QA visual inspection
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
⚠️ OPTIONAL — QA features will be unavailable:
▸ LibreOffice — Optional, needed for QA visual inspection
$ sudo apt install libreoffice # Ubuntu/Debian
$ brew install --cask libreoffice # macOS
▸ pdftoppm — Optional, needed for QA visual inspection
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
⚠️ OPTIONAL — QA features will be unavailable:
▸ LibreOffice — Optional, needed for QA visual inspection
$ sudo apt install libreoffice # Ubuntu/Debian
$ brew install --cask libreoffice # macOS
▸ pdftoppm — Optional, needed for QA visual inspection
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
⚠️ OPTIONAL — QA features will be unavailable:
▸ LibreOffice — Optional, needed for QA visual inspection
$ sudo apt install libreoffice # Ubuntu/Debian
$ brew install --cask libreoffice # macOS
▸ pdftoppm — Optional, needed for QA visual inspection
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
$ brew install --cask libreoffice # macOS
▸ pdftoppm — Optional, needed for QA visual inspection $ sudo apt install poppler-utils # Ubuntu/Debian $ brew install poppler # macOS ══════════════════════════════════════════════════════
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
$ brew install --cask libreoffice # macOS
▸ pdftoppm — Optional, needed for QA visual inspection $ sudo apt install poppler-utils # Ubuntu/Debian $ brew install poppler # macOS ══════════════════════════════════════════════════════
Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
## Phase 1 — Requirements Gathering
**Do not run any scripts yet.** First collect everything needed through a short conversation.
### Fast-path — Skip questions when info is already provided
The skill directs the agent to ask the user a sequence of questions entirely in Chinese, which effectively imposes a specific language on the interaction. The file does not state that Chinese is optional or that the agent should adapt to the user's preferred language, so this is a natural-language locale policy issue.
The prescribed template workflow treats validation bypass as part of the normal command sequence, which is an unsafe operational default for a pipeline consuming untrusted inputs and LLM-produced JSON. In this context, the skill is designed to process arbitrary uploaded files and generated plans, so skipping validation materially increases risk.
--output presentation.pptx
--mode from-template
--template uploaded_template.pptx
--skip-validation
**Patch mode — modify specific slides without regenerating the full plan:**
Listing skip-validation among core generator flags contributes to an unsafe default posture because it presents safety-control bypass as a routine capability. The surrounding skill context is more dangerous than a closed internal tool because it accepts arbitrary user documents, templates, and LLM-generated plans.
| `analyze_template.py` | Extract template design system | — |
| `suggest_style.py` | Infer style from content | `--lang`, `--slides` |
| `validator.py` | Sanitize LLM slide plan | `--out`, `--strict` |
| `generate_ppt.py` | Build PPTX (both modes) | `--mode`, `--template`, `--skip-validation`, `--patch` |
| `template_builder.py` | Fill template via python-pptx | `--template`, `--plan`, `--output` |
| `chart_builder.py` | chart dict → PptxGenJS chart code | (imported by generate_ppt.py) |
No suspicious patterns detected.