Back to skill

Security audit

pptgenerator

Security checks for vulnerabilities and agentic risk

Overview

This is a real cloud PPT generation skill, but it under-discloses sensitive local storage and automatic reuse/upload of prior presentation data.

Install only if you are comfortable sending PPT prompts and any supplied current-presentation content to PPTUltra. Avoid using --current-ppt on sensitive or unrelated files, prefer the PPT_API_KEY environment variable over --setup, and periodically delete .history.json and .config.json if you do not want prompts, links, or credentials retained locally.

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

other

Warning
Location
scripts/generate_ppt.py:1185
Finding

Insufficiently Disclosed Transmission of Prompts and Local Presentation Contents

Content
View full analysis
str: """根据 flow 类型组装最小输入 prompt""" if flow_config.get("category") != "edit": return user_prompt sections = [f"## 当前问题\n{user_prompt.strip()}"] if operations.strip(): sections.append(f"## 操作说明\n{operations.strip()}") if current_ppt.strip() or size.strip(): ppt_section = [] if size.strip(): ppt_section.append(f"当前PPT的尺寸为 {size.strip()}") if current_ppt.strip(): ppt_section.append(current_ppt.strip()) sections.append("## 当前PPT\n" + "\n".join(ppt_section)) return "\n\n".join(sections).strip() ``` ```python final_prompt = build_prompt(flow_config, prompt, current_ppt=current_ppt, operations=operations, size=size) request_id = uuid.uuid4().hex headers = { "Request-Id": request_id, "Content-Type": "application/json", } if api_key: headers["Qid"] = api_key payload = { "ai_agent_flow_id": flow_config["flow_id"], "prompt": final_prompt, "kwargs": dict(flow_config.get("kwargs", {})), } ``` ```python with requests.post( API_URL, headers=headers, json=payload, stream=True, timeout=TIMEOUT_SECONDS, ) as response: ``` ```python def _load_current_ppt_input(value: str) -> str: if not value: return "" expanded = os.path.expanduser(value) if os.path.isfile(expanded): with open(expanded, "r", encoding="utf-8") as f: return f.read().strip() return value.strip() ``` ### Technical Analysis The script is a client for a cloud-based PPT service rather than a local presentation generator. It r ...[truncated 2454 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/generate_ppt.py:137
Finding

API Key Persisted in a Plaintext File Without Enforced Owner-Only Permissions

Content
View full analysis
Remediation
View remediation
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (21)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md
**脚本路径:** `scripts/generate_ppt.py`(相对于本 skill 目录)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md
**脚本路径:** `scripts/generate_ppt.py`(相对于本 skill 目录)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md
**脚本路径:** `scripts/generate_ppt.py`(相对于本 skill 目录)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

md
**脚本路径:** `scripts/generate_ppt.py`(相对于本 skill 目录)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

md
**脚本路径:** `scripts/generate_ppt.py`(相对于本 skill 目录)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

md
**脚本路径:** `scripts/generate_ppt.py`(相对于本 skill 目录)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

md
**脚本路径:** `scripts/generate_ppt.py`(相对于本 skill 目录)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

md
**脚本路径:** `scripts/generate_ppt.py`(相对于本 skill 目录)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

md
**脚本路径:** `scripts/generate_ppt.py`(相对于本 skill 目录)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill advertises executable behavior that can access network, environment, and local files, but it does not declare any explicit tool scope or permissions boundaries. This increases the risk of over-broad execution, accidental file access, or unintended external data transfer because operators and policy layers cannot easily constrain what the skill is allowed to do.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The natural-language description, trigger rules, workflow, and examples are entirely in Chinese, and the file does not state that language selection is optional or region-specific. This can amount to a language policy issue because it implicitly forces one locale without user opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger conditions are broad enough to match many ordinary requests about slides or presentations, causing the skill to activate in situations where the user may not intend to invoke an external PPT generation service. In context, that can lead to unnecessary transmission of user prompts or presentation content to a third-party service and increase the chance of unauthorized processing of sensitive business or educational material.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill's branding, prompts, status messages, and flow metadata are consistently Chinese-only, and the configuration hard-codes locale-like source values such as xie_n_cn. There is no indication that users may opt into another language or locale, which can violate a language-choice policy when the skill is not clearly documented as region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The API key is written to a local JSON config file with no warning, no permission hardening, and no use of a secure credential store. Local plaintext credential storage increases the chance of credential theft through multi-user access, malware, logs, or accidental inclusion in backups.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill stores user prompts, generated summaries, and PPT access/share links in a local history file without opt-in or minimization. That creates unnecessary retention of potentially sensitive business content and reusable access URLs, which could be exposed to other local users, future runs, or backup/sync systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code persists prompts and generated PPT access links locally without clear disclosure. Since prompts may contain confidential presentation content and share links may grant access to generated materials, silent storage expands the privacy and access risk beyond the immediate task.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill retains prompt text and other prior content, then makes that data available for later operations, increasing the chance of stale or sensitive data being reused and disclosed. This is especially relevant for a PPT-generation skill because presentations often contain internal reports, educational materials, or business-sensitive summaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill sends user prompts and possibly prior PPT context to a third-party remote API, but the CLI does not clearly warn users that their content will leave the local environment. In this skill's context, prompts and current PPT data may contain proprietary, personal, or confidential slide content, making undisclosed transfer materially risky.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_ppt.py (reported line 1266)May include surrounding context.

python
chunk_count = 0

    try:
        with requests.post(
            API_URL, headers=headers, json=payload,
            stream=True, timeout=TIMEOUT_SECONDS,
        ) as response:

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

For edit flows, the skill silently loads the most recent history entry and uses it as current PPT context when the user does not provide one. This can cause unintended cross-session data reuse and disclosure, especially if prior prompts or links belonged to a different presentation or user.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Silently injecting the last generated record into a new edit request risks sending unrelated prior user data to the external service and producing edits against the wrong deck. This is a cross-request data flow issue that can leak one session's content into another without deliberate user action.

Content

No source excerpt is available for this finding.