Versioned security assessment

Report ID: SA-EC738690

6/30/2026, 6:10:04 AM

pptx security assessment v5

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
pptx
Version
v5
Maintainer
K-Dense-AI
Source
github.com/K-Dense-AI/claude-scientific-skills/tree/main/scientific-skills/document-skills/pptx
Coverage
56 Files scanned · 26,540 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

High

4 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Static analysis reported many severe patterns, but most high blocker hits in schemas and markdown are false positives from OOXML vocabulary, examples, and dependency instructions. The confirmed risk is operational: helper scripts extract Office ZIP archives and run local converters, so this community skill should not be published without sandboxing guidance or safer extraction fixes.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

56 Files scanned · 26,540 Lines analyzed

4 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 3 evidence locations

Network access

May connect to external services.

Observed in 3 evidence locations

Filesystem access

May read or write local files.

Observed in 3 evidence locations

Env variables

May read values from the process environment.

Observed in 2 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 4 evidence locations

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (4)

RISK-001 High
ooxml/scripts/unpack.py:17ooxml/scripts/validation/base.py:891ooxml/scripts/validation/docx.py:201ooxml/scripts/validation/redlining.py:70
Unsafe ZIP Extraction of Office Documents
Multiple helper scripts call zipfile extractall on user-provided Office files. A crafted PPTX, DOCX, or related archive could use traversal paths to write outside the intended directory unless extraction is sandboxed or validated.
The reported locations show direct archive extraction without visible member path validation. Office files are ZIP containers, so this is a credible zip-slip risk for untrusted inputs.
RISK-002 Medium
ooxml/scripts/pack.py:103scripts/thumbnail.py:219scripts/thumbnail.py:237ooxml/scripts/validation/redlining.py:153ooxml/scripts/validation/redlining.py:185
Local Command Execution in Conversion Helpers
The skill includes helper scripts and instructions that run local tools such as soffice, pdftoppm, git diff, and Chromium. Arguments are mostly structured arrays or documented commands, but document converters increase risk when processing untrusted files.
The subprocess calls are real and execute external binaries, but reviewed examples use fixed command arrays rather than shell string interpolation. Risk depends mainly on input document trust and runtime sandboxing.
RISK-003 Medium
SKILL.md:516-517
Privileged Dependency Installation Instructions
The skill documentation recommends sudo apt-get installation for LibreOffice and Poppler. This is not malicious by itself, but marketplace users should avoid running privileged installation commands from community skills without review.
The static finding maps to explicit sudo installation instructions in the dependency section. The intent is dependency setup, but elevated package installation is a real operational risk.
RISK-004 Low
scripts/inventory.py:311
Hidden Home Directory Font Lookup
The inventory helper includes ~/.fonts as a font search path on Linux. This accesses user-local font files but does not show credential collection or network transmission.
The hidden path access is real, but the semantic context is font discovery. This is a filesystem privacy concern rather than evidence of secret harvesting.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (3)
Low
scripts/html2pptx.js:898
Environment Access Limited to Temporary Directory Configuration
The reported environment access in html2pptx reads TMPDIR to choose a temporary directory for Chromium-related work. I did not find evidence that secrets are read or transmitted at this location.
The line uses process.env.TMPDIR with a /tmp fallback. This is normal temporary directory configuration and does not show credential access.
Low
ooxml/schemas/ISO-IEC29500-4_2016/xml.xsd:2ooxml/schemas/microsoft/wml-2012.xsd:2-3ooxml/schemas/ISO-IEC29500-4_2016/dml-main.xsd:2725ooxml/schemas/ISO-IEC29500-4_2016/sml.xsd:571
OOXML Schema Terms Misclassified as Security Blockers
Many high blocker, network, weak-crypto, C2, and path traversal detections occur inside standards schemas and namespace declarations. These files define OOXML and XML vocabularies rather than executable behavior.
The sampled locations are XSD schema declarations, XML namespace URLs, enum names, or relative schema imports. They are not code paths and do not establish malicious intent.
Low
SKILL.md:1-3
No Prompt Injection Evidence Found
Targeted review did not find text instructing the evaluator to ignore instructions, skip analysis, claim pre-approval, or override the audit methodology. No prompt injection finding is supported by the reviewed evidence.
The checked skill instructions describe PPTX workflows and metadata. This is a negative finding based on targeted review, so confidence is high but not absolute.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable