slide-maker
Pass
Audited by Gen Agent Trust Hub on Jul 5, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill follows established security and design best practices for AI agents. It implements an actor-critic loop to verify generated content against provided source material, reducing the risk of hallucinations or misrepresentation.
- [COMMAND_EXECUTION]: Several scripts (render_deck.py, icons.py, generate_images_codex.py) utilize subprocess.run to invoke external utilities such as soffice (LibreOffice), rsvg-convert, and the codex CLI. These executions are scoped to local file processing and well-known, legitimate tools required for the skill's primary functionality (rendering slides and icons).
- [EXTERNAL_DOWNLOADS]: The skill fetches SVG icons from a public CDN (cdn.jsdelivr.net) and communicates with the OpenAI API for image generation. These are standard operations for the skill's features and target well-known, trusted domains.
- [DYNAMIC_EXECUTION]: The check_env.py script uses dynamic imports (import) to verify the presence of required Python libraries. This is a standard environment check and does not involve executing untrusted code strings.
- [DATA_EXFILTRATION]: No patterns of sensitive data exfiltration were found. The skill operates on user-provided local files and saves outputs to the user's Downloads folder. Usage of home directory paths (~/.codex, ~/.claude) is strictly for skill configuration and template storage as per platform standards.
Audit Metadata