The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/thumbnail.py script executes the system utilities soffice (LibreOffice) and pdftoppm (Poppler) using subprocess.run. These calls use argument lists rather than shell strings, which is a secure implementation that prevents shell command injection.
[EXTERNAL_DOWNLOADS]: The documentation identifies several external dependencies required for full functionality, including markitdown, Pillow, and pptxgenjs. These are standard, reputable packages sourced from official public registries (PyPI and NPM).
[PROMPT_INJECTION]: The skill processes user-supplied .pptx files for text extraction and visual QA, which presents a surface for indirect prompt injection.
Ingestion points: scripts/check_fragility.py, scripts/thumbnail.py, and the markitdown tool read content from external files.
Boundary markers: No explicit delimiters are implemented within the scripts for the extracted data.
Capability inventory: The skill has the capability to write files, execute designated system tools, and install packages.
Sanitization: Data is processed through established libraries for ZIP handling and XML parsing, which are standard for these file formats.
[REMOTE_CODE_EXECUTION]: The skill utilizes dynamic execution in two ways: it generates Node.js scripts using the PptxGenJS library to programmatically build slides, and it uses Python's importlib in scripts/thumbnail.py to load a helper script (soffice.py) from a computed relative path within its own repository structure. These patterns are used for core functionality and modularity and do not ingest untrusted data for execution.

pptx-custom