The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits a significant attack surface for indirect prompt injection by ingesting untrusted external data.
Ingestion points: Web article content is fetched via URL in scripts/classify_input.py and processing instructions, and existing presentation structures are extracted in scripts/reconstruct_analyzer.py.
Boundary markers: There are no explicit boundary markers or instructions for the model to ignore embedded commands in the ingested data before it is passed to agents like the Localizer or Summarizer.
Capability inventory: The skill possesses extensive capabilities, including file writing (output_ppt/), network access (downloading images), and shell command execution (running its own pipeline via subprocess).
Sanitization: While the workflow is segmented into phases, there is no evidence of robust sanitization of the extracted text content to prevent it from influencing agent behavior during translation or summarization.
[EXTERNAL_DOWNLOADS]: The skill facilitates the download of external content at runtime.
In scripts/create_from_template.py and scripts/create_ja_pptx.py, the urllib.request.urlretrieve function is used to download images from arbitrary URLs provided in the content.json configuration.
scripts/create_pptx.js similarly uses the https and http Node.js modules to fetch images from remote URLs.
These operations are intended for the primary purpose of the skill (inserting images into slides) and do not target sensitive local files.
[COMMAND_EXECUTION]: Several scripts utilize subprocess execution for workflow management and metadata retrieval.
scripts/resume_workflow.py uses subprocess.run to execute other scripts in the pipeline (e.g., validate_content.py, create_from_template.py).
scripts/create_from_template.py and scripts/pptx-signature.js execute git remote get-url to determine the repository attribution URL.
scripts/resume_workflow.py uses subprocess.run(["start", pptx_file], shell=True) on Windows to open the final product. While pptx_file is derived from a sanitized base name, the use of shell=True is noted as a standard practice for this operation.

powerpoint-automation