slide-inspector
Fail
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: HIGHDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: The
scripts/calibrate.shscript is designed to access and extract data from the user's AI conversation history stored in~/.claude/projects. This directory contains full session logs, which may contain private communications, credentials, or proprietary information from other projects. While described as a 'calibration' feature to learn user style, this broad access to sensitive internal application data presents a high risk of unintended data exposure. - [COMMAND_EXECUTION]: The
scripts/inspect_slides.pyutility uses the standardxml.etree.ElementTreelibrary for parsing PPTX files. This library is explicitly documented as insecure against maliciously crafted XML content. The script is vulnerable to XML External Entity (XXE) attacks, which an attacker could exploit by providing a malicious PowerPoint file to read local files or interact with internal network resources.
Recommendations
- AI detected serious security threats
Audit Metadata