corespeed-slide

• Outcome: Review
• Latest audit: Sep 14, 2026 · 9:07 PM UTC
• Version: 1.0.0

Overview

This PowerPoint-generation skill is coherent, but it asks agents to run an unverified remote installer and execute user deck files with broad local file access.

Review before installing. Prefer installing Deno yourself through a trusted package manager, avoid the automatic remote shell installer, and only generate decks from TSX files you wrote or trust. Run the generator with path-scoped read/write permissions where possible.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:15
• Finding: Unverified Remote Installer Piped Directly into a Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:15` **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High ### Vulnerable Code ```json "command": "curl -fsSL https://deno.land/install.sh | sh", ``` ### Technical Analysis The installation command downloads a mutable script from an external URL and immediately sends its contents to `sh`. The script is neither pinned to a specific immutable version nor verified using a cryptographic checksum or signature before execution. HTTPS authenticates the network endpoint, but it does not guarantee that the returned installer will remain unchanged or uncompromised. The effective code executed during installation can therefore differ from the code reviewed during this audit. Although the URL belongs to the official Deno domain, direct `curl | sh` execution creates a remote code-execution channel. This behavior is unnecessary when Deno is already installed and exceeds the minimum privileges required merely to generate a PowerPoint file. ### Attack Path 1. A user or automation platform installs the Skill on a host where Deno is unavailable. 2. The installation framework invokes the shell command from `SKILL.md`. 3. `curl` retrieves the current response from `https://deno.land/install.sh`. 4. The response is passed directly to `sh` without local review, version pinning, checksum verification, or signature validation. 5. If the upstream site, CDN, delivery path, or installer is compromised, attacker-controlled shell commands execute with the privileges of the user installing the Skill. ### Impact Assessment A malicious installer response could execute arbitrary commands with the invoking user's privileges. Depending on those privileges and local system controls, this could allow: - Reading, modifying, or deleting user-accessible files. - Installing additional executables or malicious dependencies. - Accessing credentials and configuration available to the invokin ...[truncated 312 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove automatic `curl | sh` installation and require Deno to be installed separately through a trusted package manager. 2. If automated installation is essential, download a versioned release artifact to a local file rather than piping it directly into a shell. 3. Pin the installer or release artifact to an explicit Deno version. 4. Verify the downloaded artifact against an independently published SHA-256 checksum or cryptographic signature before execution. 5. Present the installation action to the user for explicit approval. 6. Run installation with the lowest-privileged account possible and never request administrative privileges unless strictly required. 7. Skip installation entirely when a compatible Deno binary is already available. 8. Document the expected filesystem changes so users can review the installation's scope. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate.ts:33
• Finding: Untrusted TypeScript Deck Files Execute with Broad Filesystem Permissions<![CDATA[ ## Vulnerability Details **File Location**: `scripts/generate.ts:33` **Related Permission Declaration**: `SKILL.md:27` **Vulnerability Type**: Dynamic execution of input files with unrestricted filesystem access **Risk Level**: Medium ### Vulnerable Code ```ts const [inputFile, outputFile] = filteredArgs; const inputPath = resolve(inputFile); const outputPath = resolve(outputFile); try { const mod = await import(`file://${inputPath}`); if (!mod.deck) { const msg = `Error: ${inputFile} must export a "deck" variable`; ``` The documented invocation grants unrestricted read and write permissions: ```bash deno run --allow-read --allow-write --config {baseDir}/scripts/deno.json {baseDir}/scripts/generate.ts slides.tsx output.pptx [--json] ``` ### Technical Analysis The generator treats the supplied `.tsx` deck as an executable module rather than as passive presentation data. A dynamic module import executes all top-level code in the selected file before the exported `deck` value is validated. The Deno process is launched with unrestricted `--allow-read` and `--allow-write` permissions. Consequently, imported deck code inherits permission to read and modify any filesystem location accessible to the invoking user. The permissions are broader than the minimum required operation, which only needs to read the selected source and dependencies and write the requested output file. Network and subprocess permissions are not granted by the documented command, which limits the direct attack surface. Nevertheless, unrestricted filesystem access may expose local secrets or permit destructive file modification if an attacker can supply or influence the deck source. ### Attack Path 1. An attacker creates or modifies a `.tsx` deck file containing malicious top-level TypeScript. 2. The user or agent invokes the generator with that file as the input. 3. Deno starts with unrestricted `--allow-read` and `--allow-write` permissions. 4. `generate.ts` resol ...[truncated 1203 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat every `.tsx` deck as executable code and clearly warn users not to process untrusted or externally supplied deck files. 2. Replace unrestricted permissions with path-scoped permissions, for example: - `--allow-read=<input-file>,<required-cache-or-module-paths>` - `--allow-write=<output-file>` 3. Resolve and validate the input and output paths before execution, and ensure they fall within explicitly approved directories. 4. Where feasible, replace executable TSX input with a declarative format such as validated JSON that cannot run arbitrary top-level code. 5. If TSX support must remain, execute deck evaluation in an isolated process or container with: - A dedicated temporary working directory. - Read-only access to the selected input. - Write access limited to the designated output directory. - No network, subprocess, environment, or system-directory access. 6. Avoid running the generator under an administrative or otherwise privileged account. 7. Document that checking for `mod.deck` after import is not a security boundary because module code has already executed. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

External Script Fetching

High

• Category: Supply Chain

Content

{
              "id": "deno-install",
              "kind": "shell",
              "command": "curl -fsSL https://deno.land/install.sh | sh",
              "bins": ["deno"],
              "label": "Install Deno (https://deno.land)",
            },

• Confidence: 97% confidence
• Finding: Direct external script fetching and piping to `sh` is a classic arbitrary code execution pattern. If the remote endpoint, transport, or upstream distribution is compromised, the host running the skill can be fully compromised during installation.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The description says to use the skill whenever a user asks to create presentations, slide decks, pitch decks, reports, or any PPTX file, which is broad enough to trigger in many common contexts. Over-broad routing can cause unnecessary activation of a skill that includes code execution and installation behavior, increasing exposure to its riskier capabilities.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill embeds an install step that executes a remotely fetched shell script via `curl | sh`. That gives arbitrary code execution on the host during skill setup, and while installing Deno is relevant to the skill, using an unchecked remote script is far more privileged and risky than necessary for presentation generation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The installation instructions include `curl -fsSL https://deno.land/install.sh | sh` without any user-facing warning that it modifies the system and executes remote code. In an agent context, this is dangerous because it can normalize or automate a high-risk action without informed user approval.

Static analysis

No suspicious patterns detected.