Frontend Slides

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:17 PM UTC
• Version:
  1.0.0

Overview

This skill is a coherent local presentation builder with expected file, browser, and PowerPoint-conversion behavior, but users should mind local persistence and external font loading.

Safe to install for local slide generation and PPT conversion. For confidential presentations, ask the agent to skip inline editing, avoid remote font links, preserve or delete extracted PPTX assets deliberately, and review generated HTML before opening it if the source content is untrusted.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill clearly instructs the agent to create and modify files, save previews, generate HTML outputs, and delete generated artifacts, yet it does not declare corresponding permissions. This creates a transparency and governance gap: the agent may perform filesystem writes or cleanup actions that users and platform policy do not expect or explicitly authorize.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence
• Finding: The skill description presents a presentation-generation/conversion tool, but the instructions also cover extracting PowerPoint contents, speaker notes, and writing extracted assets to disk. That mismatch matters because speaker notes may contain sensitive internal commentary, and writing extracted material locally expands data exposure beyond what a user may infer from the top-level description.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: The skill offers in-browser editing with auto-save to localStorage but does not clearly warn users that presentation content will persist in the browser. On shared or managed devices, that can leave sensitive draft material accessible after the session and violate user expectations about ephemeral editing.

Missing User Warnings

Low

• Confidence: 73% confidence
• Finding: The instruction to delete generated preview files performs cleanup that may remove artifacts the user expected to inspect, keep, or audit later, without explicit warning. While not inherently dangerous, silent deletion is a transparency issue and can cause loss of user work product or hinder review of generated outputs.

VirusTotal

65/65 vendors flagged this skill as clean.