Artifact Deck

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:39 PM UTC
• Version:
  1.0.6

Overview

Artifact Deck is a local presentation-building skill that reads user-selected notes and screenshots and writes deck-related output files, with no evidence of hidden network, credential, purchase, or persistence behavior.

Install only if you are comfortable running local Python scripts on files you choose. Use a trusted Python environment for python-pptx, provide only curated notes and screenshots, write outputs inside a known workspace folder, and review the PPTX plus manifest/build JSON before sharing because selected content and local paths may be included.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill clearly instructs the agent to read local markdown and image files and to write manifests, JSON summaries, markdown output, and a PPTX, but it does not declare corresponding permissions. This creates a policy/visibility gap: users and enforcement layers may not realize the skill can access arbitrary local paths supplied in arguments, increasing the chance of unintended data exposure or file modification.

VirusTotal

66/66 vendors flagged this skill as clean.