The Agent Skills Directory

[COMMAND_EXECUTION]: Several scripts execute external system utilities for document conversion and image generation.
Evidence: subprocess.run calls to soffice (LibreOffice) and pdftoppm in ooxml/scripts/pack.py and scripts/thumbnail.py.
Risk: While shell injection is avoided by passing arguments as lists, these tools process untrusted slide data that may contain malicious payloads targeting the utilities themselves.
[DYNAMIC_EXECUTION]: The skill uses Playwright to render HTML into slides, creating a potential sandbox escape or local file access vector.
Evidence: Headless Chromium usage in scripts/html2pptx.js via chromium.launch() and page.goto().
Risk: AI-generated or user-provided HTML containing malicious JavaScript could attempt to read sensitive local system files via the browser's file:// protocol.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted presentation data and provides several powerful capabilities that could be exploited via malicious inputs.
Ingestion points: ooxml/scripts/unpack.py, scripts/inventory.py, and ooxml/scripts/validation/redlining.py ingest content from ZIP-based .pptx archives.
Boundary markers: Absent; data is processed directly without delimiters to separate user data from internal instructions.
Capability inventory: The skill executes system commands, renders browser-based content, and performs recursive file system writes.
Sanitization: Employs defusedxml for secure XML parsing but lacks Zip Slip protection. Multiple instances of zipfile.extractall() in unpack.py and redlining.py fail to validate member paths, allowing a malicious archive to overwrite files outside the intended destination directory using ../ sequences.

pptx