Frontend Slides

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 3:49 PM UTC
• Version: 1.0.0

Overview

This skill is a presentation-generation helper with some disclosed local file creation, optional browser autosave, remote font loading, and package-install risks to consider.

Install only if you are comfortable with the skill creating local HTML/assets, optionally storing edits in browser localStorage, opening generated files in a browser, and using remote fonts. For PPT conversion or image processing, prefer a virtual environment with pinned dependencies instead of installing packages into a shared Python environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:192

Finding

Unpinned Dependencies Installed into the Active Python Environment

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 192
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code Snippet:

markdown

1. **Extract content** — Run `python scripts/extract-pptx.py <input.pptx> <output_dir>` (install python-pptx if needed: `pip install python-pptx`)

Technical Analysis

The skill instructs the agent to install python-pptx from the default Python package index without a version constraint, hash verification, lock file, isolated virtual environment, or explicit trusted index. A similar optional instruction for Pillow appears in html-template.md.

Although the named packages are legitimate, an unpinned installation resolves to whichever release the package index considers current at execution time. Consequently, the effective dependency code can change after this skill has been audited. A compromised publisher account, malicious future release, package-index compromise, or compromised dependency in the transitive dependency graph could introduce attacker-controlled code.

Python packages can execute code during installation or when imported. The extractor subsequently imports the installed dependency with:

python

from pptx import Presentation

The dependency therefore receives an execution opportunity under the identity and environment of the agent running the skill.

Attack Path

1. An attacker compromises the upstream package, a transitive dependency, a publisher account, or the configured Python package index.
2. The attacker publishes a malicious version that satisfies the unconstrained package request.
3. A user asks the skill to convert a PowerPoint file on a system where python-pptx is unavailable.
4. Following SKILL.md, the agent runs pip install python-pptx.
5. Pip selects and installs the attacker-controlled release into the active environment.
6. Malicious installation hooks ...[truncated 916 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every dependency to an audited version, for example through a version-controlled requirements file.

• Use hashes and require them during installation:

  text

  python-pptx==AUDITED_VERSION --hash=sha256:EXPECTED_HASH
  

  bash

  python -m pip install --require-hashes -r requirements.txt
  

• Pin and hash transitive dependencies as well, using a reproducible lock-generation process.

• Install dependencies inside a dedicated virtual environment rather than the user's global or shared Python environment.

• Use python -m pip tied to the intended interpreter instead of an ambiguous pip executable.

• Configure an approved package index and disable unexpected additional indexes to reduce dependency-confusion exposure.

• Apply the same controls to the Pillow installation documented in html-template.md.

• Prefer a prebuilt, reviewed execution environment where dependencies are installed before the skill runs.

• Document that dependency installation causes third-party code to execute and require confirmation before changing the environment.

other

Note

• Location: html-template.md:14

Finding

Generated Presentations Load Mutable Third-Party Font Stylesheets

Content

View full analysis

Vulnerability Details

File Location: html-template.md, lines 14-16
Vulnerability Type: External resource privacy and integrity exposure
Risk Level: Low

Vulnerable Code Snippet:

html

<!-- Fonts: use Fontshare or Google Fonts — never system fonts -->
<link rel="stylesheet" href="https://api.fontshare.com/v2/css?f[]=...">

Technical Analysis

The template directs generated presentations to load a stylesheet from a third-party font service. This conflicts with the project's description of presentations as self-contained and causes local presentations to initiate network requests when opened.

The remote provider receives connection metadata such as the viewer's IP address, request time, user agent, and potentially referrer information. The returned stylesheet and referenced font resources are mutable external content that can change after presentation generation and after this skill's review.

A compromised provider, account, DNS path, or delivery infrastructure could alter the stylesheet or its referenced assets. Remote CSS does not inherently grant arbitrary JavaScript execution, and no such payload exists in the audited files. However, attacker-controlled CSS can alter or conceal presentation content, trigger additional cross-origin resource requests, and create limited CSS-based disclosure channels when combined with sensitive DOM state.

Attack Path

1. The skill generates an HTML presentation containing the external Fontshare or Google Fonts stylesheet reference.
2. The presentation is opened while the viewer is online.
3. The browser contacts the third-party service, disclosing normal HTTP connection metadata.
4. If the service or resource-delivery path has been compromised, the browser receives attacker-controlled CSS or font-resource references.
5. The malicious stylesheet changes the presentation's appearance, conceals or overlays content, or causes requests to attacker-c ...[truncated 946 chars]

Remediation

View remediation

Remediation Suggestions

• Bundle reviewed font files with the presentation or embed them as local data resources so the presentation remains deterministic and offline.

• If a single-file artifact is required, embed font files with @font-face and data URLs after verifying their license and integrity.

• Remove the mandatory instruction to use externally hosted fonts; permit locally bundled or privacy-preserving fallback fonts.

• Add a restrictive Content Security Policy. For fully self-contained presentations, use a policy that blocks network access, such as:

  html

  <meta http-equiv="Content-Security-Policy"
        content="default-src 'none'; style-src 'unsafe-inline'; font-src data:; img-src 'self' data:; script-src 'unsafe-inline'; connect-src 'none'">
  

• If remote fonts must remain supported, disclose the resulting third-party requests and make them an explicit user choice.

• Restrict style-src and font-src to an allowlist of required origins and set referrerpolicy="no-referrer" on external stylesheet links where browser support permits.

• Avoid claiming generated files are entirely self-contained when they depend on remote font infrastructure.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description emphasizes building rich HTML presentations and converting PowerPoint files into web presentations. The supplied code does not create presentations, generate HTML, apply animations, or provide design assistance. Its behavior is limited to parsing a PPTX file and exporting its contents as JSON plus extracted image files. While PPTX extraction could be a supporting step in a conversion pipeline, this code chunk by itself has a materially narrower and different primary purpose than the declared skill.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · html-template.md (reported line 15)May include surrounding context.

md

<meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Presentation Title</title>

    <!-- Fonts: use Fontshare or Google Fonts — never system fonts -->
    <link rel="stylesheet" href="https://api.fontshare.com/v2/css?f[]=...">

    <style>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 7)May include surrounding context.

md

## What This Does

**Frontend Slides** helps non-designers create beautiful web presentations without knowing CSS or JavaScript. It uses a "show, don't tell" approach: instead of asking you to describe your aesthetic preferences in words, it generates visual previews and lets you pick what you like.

Here is a deck about the skill, made through the skill:

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 30)May include surrounding context.

bash

# Create the skill directory
mkdir -p ~/.claude/skills/frontend-slides/scripts

# Copy all files (or clone this repo directly)
cp SKILL.md STYLE_PRESETS.md viewport-base.css html-template.md animation-patterns.md ~/.claude/skills/frontend-slides/

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill instructs the agent to create and modify files, save previews, delete directories, and generate HTML artifacts, but it does not declare any explicit tool scope or allowed-tools boundary. This weakens least-privilege controls and can let a runtime grant broader file-write capability than users or reviewers expect.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

md

4. **After ANY modification, verify:** `.slide` has `overflow: hidden`, new elements use `clamp()`, images have viewport-relative max-height, content fits at 1280x720
5. **Proactively reorganize:** If modifications will cause overflow, automatically split content and inform the user. Don't wait to be asked

**When adding images to existing slides:** Move image to new slide or reduce other content first. Never add images without checking if existing content already fills the viewport.

---

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill directs the agent to run shell commands and install a Python package (pip install python-pptx) during PPT conversion. Allowing package installation and shell execution expands the attack surface beyond simple presentation authoring, introducing supply-chain and environment-modification risk if used in sensitive or shared runtimes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The template hard-codes <html lang="en">, which forces a specific language/locale in the generated output. Under the policy, locale constraints should be user-selectable or clearly justified as region-specific; neither is present here.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

The template requires loading fonts from Fontshare or Google Fonts, which causes the presentation to contact third-party servers when opened. In a locally viewed presentation workflow, this leaks viewer metadata such as IP address, user agent, and access timing, and also creates a supply-chain and availability dependency on external infrastructure.

Content

Scanner excerpt · html-template.md (reported line 16)May include surrounding context.

md

<title>Presentation Title</title>

    <!-- Fonts: use Fontshare or Google Fonts — never system fonts -->
    <link rel="stylesheet" href="https://api.fontshare.com/v2/css?f[]=...">

    <style>
        /* ===========================================

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill offers inline editing with automatic localStorage persistence but does not require a clear disclosure that presentation content will be stored in the browser. This can cause unintended retention of sensitive material on shared devices or in regulated environments, even though the storage is client-side rather than exfiltrated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file instructs implementations to include auto-save to localStorage and export/save file functionality, both of which can affect user data handling and persistence. The surrounding text marks inline editing as opt-in, but it does not explicitly warn users that edits may be stored locally or written out to files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.