Security audit

GLM-V-PDF-to-PPT

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its PDF-to-slide purpose, but it has real safety issues around unbounded URL downloads and output file handling that users should review before installing.

Install only if you are comfortable with a skill that can download user-provided URLs, read full PDFs, spawn bounded crop subagents, and write presentation files. Prefer local PDFs, run it in a restricted workspace, pin dependencies, and fix the crop filename containment and HTML escaping issues before using it on untrusted documents or URLs.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:20
Finding: Unpinned Third-Party Dependencies Create a Supply-Chain Risk
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/crop.py:55
Finding: Path Traversal Through an Unsanitized Crop Output Name
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/generate_slide.py:27
Finding: Unescaped Presentation Title Enables HTML and Script Injection
Content: View full analysis
str: """Generate index.html with navigation links to all slides.""" slides_html = [] for i in range(1, total + 1): slides_html.append( f'' f'{i}' f"" ) html = f""" {title} — Slides *{{margin:0;padding:0;box-sizing:border-box}} body{{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif;background:#f0f2f5;color:#1a1a2e;display:flex;flex-direction:column;align-items:center;padding:60px 20px;min-height:100vh}} h1{{font-size:1.8em;margin-bottom:8px;text-align:center}} .subtitle{{color:#64748b;margin-bottom:40px;font-size:.95em}} .grid{{display:grid;grid-template-columns:repeat(auto-fill,minmax(120px,1fr));gap:16px;max-width:800px;width:100%}} .slide-link{{display:flex;align-items:center;justify-content:center;background:#fff;border:1px solid #e2e8f0;border-radius:12px;padding:28px 20px;text-decoration:none;color:#1a1a2e;font-weight:600;font-size:1.3em;transition:all .2s;box-shadow:0 1px 3px rgba(0,0,0,.06)}} .slide-link:hover{{background:#2563eb;color:#fff;transform:translateY(-3px);box-shadow:0 8px 25px rgba(37,99,235,.25)}} .slide-link .num{{}} .start{{margin-top:40px;display:inline-flex;align-items:center;gap:8px;padding:14px 36px;background:#2563eb;color:#fff;border-radius:10px;text-decoration:none;font-weight:600;font-size:1.05em;transition:all .2s}} .start:hover{{background:#1d4ed8;transform:translateY(-2px);box-shadow:0 4px 12px rgba(37,99,235,.3)}}
Remediation: View remediation
` and `
` elements. 2. Treat all metadata derived from PDFs, filenames, model output, and command-line arguments as untrusted. 3. Use an HTML templating system with automatic escaping if the generator becomes more complex. 4. Apply a restrictive Content Security Policy when presentations are served over HTTP, for example by disallowing inline scripts and limiting network destinations. 5. Add tests with titles containing `

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose describes a document-to-presentation pipeline: ingesting PDFs and producing multi-slide HTML presentations plus outline/summary artifacts. The supplied code does none of that. Its sole function is to crop a region from a local image and save it as a PNG. This is a materially different primary purpose and capability set. While JSON is printed, it only contains the saved image path, not a presentation outline. Therefore the description does not accurately represent the actual behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description promises an end-to-end skill that converts PDFs/documents into a polished multi-slide HTML presentation and also outputs outline JSON and summary markdown. The supplied code chunk only handles a later-stage file operation: saving an already-rendered HTML slide into a destination folder and generating an index.html navigation page once all slides are present. There is no PDF reading, text extraction, summarization, outline generation, or slide content generation in this code. While this script could be a supporting component within a larger slide-generation pipeline, taken on its own it does not accurately match the declared primary purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose describes an end-to-end PDF-to-presentation skill that should produce polished HTML slides, an outline JSON, and a markdown summary. The supplied code only renders each PDF page as a PNG image and prints metadata about those images. While PDF page rendering could be a supporting sub-step in a larger slide-generation pipeline, this chunk by itself does not implement the declared primary functionality and lacks the key promised outputs. Therefore, the description materially overstates what the code actually does.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill instructs the agent to perform shell commands and write files, but the manifest does not declare any explicit tool scope or allowed-tools boundaries. That increases the blast radius if the skill is triggered unexpectedly or modified later, because the agent may execute filesystem and shell actions without a clearly constrained permission model.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The activation guidance includes broad phrases such as "做PPT", "做幻灯片", and "or any similar intent in Chinese or English," which can overlap with common requests and lacks clear boundaries for when this specific skill should or should not activate. The manifest description also says to trigger when the user mentions making slides or a PPT from a PDF, but does not provide exclusion conditions or negative examples.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The workflow allows downloading arbitrary user-supplied HTTP/HTTPS URLs with curl, despite the skill being presented as a local PDF conversion tool. This expands the trust boundary to remote content and can enable SSRF-like access to internal resources, retrieval of malicious files, or unexpected network egress in environments where the agent has privileged connectivity.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: A document conversion skill can reasonably read a local PDF and produce slides, but downloading arbitrary URLs is a separate capability that is not stated in the manifest. Because the skill's declared purpose is conversion rather than web retrieval, adding general HTTP/HTTPS fetching is context-expanding behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The instructions require lang to be either Chinese or English to match the PDF language, and later state "No mixing," which removes user choice over output language. This is a natural-language locale policy concern because the skill mandates a language behavior rather than offering the user an explicit opt-in or override.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The language policy says to match the PDF language exactly and forbids mixing, which imposes a fixed locale behavior. There is no indication that the user may request a different output language or confirm this preference, so the skill enforces language selection without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script prints all user-facing status and completion messages in Chinese, including progress and output-location information. This imposes a specific language on users without opt-in or justification, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill performs network access to user-supplied URLs without an explicit warning or consent step. In agent environments, silent network egress can leak metadata, surprise users, and fetch untrusted content without clear acknowledgment of the privacy and security implications.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.