PPT生成与修改

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:20 AM UTC
• Version: 1.0.0

Overview

The skill mostly does what it says, but its file-writing behavior is under-contained and can be influenced to write PowerPoint files outside the intended output folder.

Review before installing. This skill is not clearly malicious, but it should be fixed to sanitize output filenames, keep writes inside approved directories, avoid collision-prone filenames, and pin dependencies before use in shared or sensitive environments.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: ppt_generator.py:88

Finding

User-Controlled Presentation Title Allows Output Path Traversal

Content

View full analysis

Vulnerability Details

File Location: ppt_generator.py, lines 88-91
Vulnerability Type: Path traversal and arbitrary file creation
Risk Level: High

python

output_directory = ensure_directory(output_dir)
output_path = output_directory / f"{title.replace(' ', '_')}_{timestamp_str()}.pptx"
prs.save(str(output_path))
logger.info("create_ppt completed output=%s", output_path)

Technical Analysis

The public create_ppt() interface accepts a caller-controlled title, which is incorporated into the output filename. The only transformation replaces spaces with underscores. It does not remove path separators, traversal components, absolute path prefixes, or platform-specific special characters.

When pathlib.Path joins a directory with an absolute right-hand path, the original directory is discarded. Therefore, a title such as /tmp/attacker/result produces an output path outside the intended ppt_skill/output directory. Relative traversal components such as ../ may also escape the output directory when the resulting parent directories exist.

The final prs.save() operation writes to the resulting attacker-influenced path without resolving the destination or verifying that it remains inside the configured output directory.

Attack Path

1. An attacker supplies a path-shaped title to the agent-facing create_ppt() API.
2. main.create_ppt() forwards the title unchanged to ppt_generator.create_ppt().
3. The implementation only replaces spaces and retains absolute-path or traversal syntax.
4. Path constructs a destination outside the intended output directory.
5. prs.save() creates or replaces a .pptx file at that unintended destination.

Impact Assessment

An attacker can cause arbitrary .pptx file creation or replacement at locations writable by the process account. The vulnerability does not directly grant additional operating-system privileges, but it crosses the intended ...[truncated 335 chars]

Remediation

View remediation

Remediation Suggestions

• Do not derive filesystem paths directly from presentation titles. Generate the stored filename using a server-controlled UUID or cryptographically random identifier.
• If a human-readable component is required, reduce the title to a basename and allow only a strict character set such as letters, digits, underscores, and hyphens.
• Resolve both the output directory and candidate destination with Path.resolve(), then verify that the destination is a child of the approved output directory before writing.
• Reject absolute paths, .. components, directory separators, drive prefixes, and empty sanitized names.
• Use exclusive file creation or another collision-resistant mechanism to prevent unintended replacement of an existing destination.
• Keep the original title only as presentation metadata rather than using it as a filesystem path.

T09 · Insecure Skill Coding Practices

Warning

• Location: utils.py:31

Finding

Second-Resolution Output Naming Does Not Prevent File Overwrites

Content

View full analysis

Vulnerability Details

File Location: utils.py, lines 31-33 and 42-46; save operation in ppt_editor.py, lines 118-119
Vulnerability Type: Predictable filename collision and unsafe file overwrite
Risk Level: Medium

python

def timestamp_str() -> str:
    """Return a compact timestamp used in generated output filenames."""
    return datetime.now().strftime("%Y%m%d_%H%M%S")

python

def build_non_overwrite_path(path: str | Path, suffix: str = "_updated") -> Path:
    """Return a non-overwriting path by appending a suffix and timestamp."""
    src = Path(path)
    target_name = f"{src.stem}{suffix}_{timestamp_str()}{src.suffix}"
    return src.with_name(target_name)

python

output_path = build_non_overwrite_path(ppt_file, suffix="_replaced")
prs.save(str(output_path))

Technical Analysis

The helper is named build_non_overwrite_path, but it neither checks whether the generated path already exists nor reserves the filename atomically. Its uniqueness mechanism is a timestamp with only one-second precision.

Two updates of the same source presentation during the same second produce an identical output filename. The subsequent prs.save() call is not protected by an exclusive-creation operation, so a later request can overwrite the output generated by an earlier request. A race is also possible when concurrent workers calculate the same path before either has finished saving.

Attack Path

1. Two concurrent or rapid sequential requests call update_ppt() for the same source file.
2. Both requests execute timestamp_str() during the same second.
3. Both derive the same source stem, suffix, timestamp, and extension.
4. Both receive the same output path from build_non_overwrite_path().
5. The later prs.save() replaces the result written by the earlier operation.

Impact Assessment

The issue can cause silent data loss, request-result confusion, and cross- ...[truncated 285 chars]

Remediation

View remediation

Remediation Suggestions

• Replace second-resolution timestamps with UUIDs or cryptographically random filename components.
• Check for existing destinations and retry with a new identifier when a collision occurs.
• Where possible, reserve files atomically using exclusive creation semantics.
• If results are associated with separate users or requests, place them in isolated per-request directories.
• Preserve the non-overwrite guarantee at the point of writing rather than relying only on filename construction.
• Add concurrency tests that invoke multiple updates for the same source and verify that every request receives a distinct output file.

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Third-Party Dependency Is Not Version-Pinned

Content

View full analysis

Vulnerability Details

File Location: requirements.txt, line 1
Vulnerability Type: Unpinned third-party dependency and non-reproducible installation
Risk Level: Low

text

python-pptx

The documented installation command in README.md, lines 27-31, consumes this dependency specification directly:

bash

pip install -r requirements.txt

Technical Analysis

The dependency declaration does not constrain python-pptx to a reviewed version and does not provide package hashes. Each installation may therefore resolve a different release from the configured package index.

This prevents reproducible builds and means a future vulnerable, incompatible, or compromised release could be installed automatically without a source-code change in this project. Hash verification is also absent, so the installation process does not validate artifacts against a project-approved digest.

Attack Path

1. A user or deployment system follows the documented installation procedure.
2. pip resolves the currently available python-pptx release from its configured package index.
3. The resolved release may differ from the version originally reviewed or tested.
4. Any vulnerability or malicious behavior in that dependency executes with the privileges of the installation or runtime process when the package is installed, imported, or used.

Impact Assessment

The precise impact depends on the behavior of the dependency version retrieved at installation time. A compromised package could potentially execute code with the privileges of the installing user or application process. A merely incompatible or vulnerable release could cause denial of service, malformed document handling, or application instability. No evidence was found that the currently named package is malicious; this finding concerns uncontrolled version resolution and missing artifact integrity controls.

Remediation

View remediation

Remediation Suggestions

• Pin python-pptx to a specific version that has been reviewed and tested.
• Generate and commit a lock file containing all transitive dependencies.
• Record cryptographic hashes and install with pip --require-hashes or an equivalent integrity-enforcing workflow.
• Use a trusted package index and prevent fallback to unapproved indexes.
• Integrate dependency vulnerability scanning and automated update review into the build pipeline.
• Test dependency upgrades before changing the pinned version rather than accepting new releases automatically.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill description promises specific editing and replacement behavior, while the documented module structure and notes indicate incomplete or different functionality, including image-generation integration points not clearly declared in the top-level description. This mismatch can mislead an agent or reviewer about what the skill actually does, causing unsafe invocation, unexpected network/service use, or trust in editing guarantees that are not implemented.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill declares capabilities to generate and modify PowerPoint files, which inherently requires writing files, but it does not declare any tool scope such as permissions or allowed-tools. In an agent environment, missing scope declarations can let the skill operate with broader-than-expected file access and makes it harder for orchestrators or reviewers to enforce least privilege.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This code sends prompts derived from replacement rules to an image generation function without any visible consent, disclosure, or policy check. In a PPT editing skill, replacement content may include sensitive business terms, names, or project details, so automatic transmission to an external image service can leak user data or confidential context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This code creates an output directory and saves a .pptx file to disk, which is a file-write operation covered by the missing user warnings rule for code files. While the function has a docstring and logs completion, there is no clear user-facing warning or confirmation that a file will be created at the specified path.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

The dependency is unpinned, so installs may resolve to different future versions of python-pptx over time. This can introduce vulnerable or breaking upstream releases into the skill without review, reducing build reproducibility and increasing supply-chain risk.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

python-pptx

Static analysis

No suspicious patterns detected.