ppt-master
Pass
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.run()to invoke external utilities like Pandoc for converting documents (e.g., .tex, .odt, .rtf) into Markdown and ImageMagick for converting Office vector images (EMF/WMF) into PNG previews. These are standard practices for cross-format document processing. - [EXTERNAL_DOWNLOADS]: The system performs network requests via
requestsandcurl_cffito retrieve web content (web_to_md.py) and uses various provider APIs to acquire images (image_gen.py,image_search.py). These operations target well-known service providers such as OpenAI, Google Gemini, Wikimedia, and Pexels. - [DYNAMIC_EXECUTION]: Dynamic module loading is implemented via
importlib.import_module()and__import__()to load internal backend and provider scripts. This modularity allows the skill to support multiple image generation and search services without bloating the main execution logic. - [INDIRECT_PROMPT_INJECTION]: As the skill ingests and processes untrusted data from documents and URLs, it possesses an inherent attack surface for indirect prompt injection. However, this is mitigated by the use of structured design specifications and quality checks (
svg_quality_checker.py) that enforce technical constraints on the generated output.
Audit Metadata