一键生成PPT截图和缩略图工具，MAC版本

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:51 AM UTC
• Version: 1.0.1

Overview

The skill mainly performs local PPT-to-image conversion, but it unnecessarily asks users for WeChat app credentials that are not used or justified by the included code.

Review this skill before installing. Use it only with PPT files and output paths you choose, verify the LibreOffice and Ghostscript paths point to trusted local binaries, and do not provide WeChat app secrets unless the publisher documents why they are needed and how they are protected.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:27

Finding

Unpinned Pillow Dependency from a Mutable Package Index

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 27
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

shell

pip3 install pillow

Technical Analysis

The installation command does not pin Pillow to a reviewed version and does not verify the downloaded artifact using a cryptographic hash. It also relies on the package index configured in the user's pip environment without requiring a trusted source.

Consequently, the installed code can change after the skill has been reviewed. A compromised package release, package index, mirror, or pip configuration could cause an attacker-controlled distribution to be installed. Python packages may execute code during installation, and the installed Pillow package is subsequently loaded by ppt2png.py through from PIL import Image.

Attack Path

1. An attacker compromises the configured package index, mirror, relevant package release, or dependency-resolution environment.
2. A user follows the documented installation instruction:

   shell

   pip3 install pillow
   

3. pip resolves and downloads mutable package content without enforcing an approved version or artifact hash.
4. Malicious package code executes during installation or when ppt2png.py imports PIL.
5. The malicious code operates with the permissions of the user who installed or executed the skill.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the installing or executing user. This could expose files and credentials accessible to that account, alter generated documents and images, or modify other user-writable resources.

The issue does not independently provide administrator privileges. Its scope is normally limited to the affected Python environment and the permissions held by the invoking user.

Remediation

View remediation

Remediation Suggestions

1. Commit a dependency file containing a reviewed, exact Pillow version rather than installing an unconstrained release.
2. Record cryptographic hashes for every permitted distribution and require hash verification:

   shell

   python3 -m pip install --require-hashes -r requirements.txt
   

3. Configure requirements.txt with an exact version and approved hashes, for example:

   text

   Pillow==REVIEWED_VERSION --hash=sha256:REVIEWED_ARTIFACT_HASH
   

4. Document and enforce the expected trusted package index rather than inheriting an arbitrary user-configured mirror.
5. Install dependencies in an isolated virtual environment with ordinary user privileges.
6. Periodically review and update the pinned version and hashes after security testing.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill asks the user to provide WeChat app credentials (appid and appsecret) but gives no warning about secure handling, storage, or whether those secrets are actually necessary for the PPT-to-image workflow. Requesting sensitive credentials in a general-purpose skill increases the risk of unnecessary secret exposure, especially because the rest of the skill is focused on local file conversion and does not clearly justify needing remote platform secrets.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file's natural-language content, including comments, exceptions, and user-facing print statements, is entirely in Chinese, which imposes a specific language on users without any opt-in or alternative. The policy allows locale constraints only when they are documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · ppt2png.py (reported line 37)May include surrounding context.

python

]

    print("正在转换 PPT → PDF ...")
    subprocess.run(cmd, check=True)

    pdf_path = output_dir / (ppt_path.stem + ".pdf")
    if not pdf_path.exists():

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · ppt2png.py (reported line 69)May include surrounding context.

python

]

    print("正在转换 PPT → PDF ...")
    subprocess.run(cmd, check=True)

    pdf_path = output_dir / (ppt_path.stem + ".pdf")
    if not pdf_path.exists():

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The natural-language instructions and example prompts are presented only in Chinese and implicitly require that language for use, without offering the user a language or locale choice. The policy calls for flagging language or locale constraints when they are forced without opt-in or clear justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.