ppt-master

Pass

Audited by Gen Agent Trust Hub on Jul 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.run() to invoke external utilities like Pandoc for converting documents (e.g., .tex, .odt, .rtf) into Markdown and ImageMagick for converting Office vector images (EMF/WMF) into PNG previews. These are standard practices for cross-format document processing.
  • [EXTERNAL_DOWNLOADS]: The system performs network requests via requests and curl_cffi to retrieve web content (web_to_md.py) and uses various provider APIs to acquire images (image_gen.py, image_search.py). These operations target well-known service providers such as OpenAI, Google Gemini, Wikimedia, and Pexels.
  • [DYNAMIC_EXECUTION]: Dynamic module loading is implemented via importlib.import_module() and __import__() to load internal backend and provider scripts. This modularity allows the skill to support multiple image generation and search services without bloating the main execution logic.
  • [INDIRECT_PROMPT_INJECTION]: As the skill ingests and processes untrusted data from documents and URLs, it possesses an inherent attack surface for indirect prompt injection. However, this is mitigated by the use of structured design specifications and quality checks (svg_quality_checker.py) that enforce technical constraints on the generated output.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 14, 2026, 10:52 AM
Security Audit — agent-trust-hub — ppt-master