code-slides
Pass
Audited by Gen Agent Trust Hub on May 14, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
scripts/generate_image_deck.pyscript fetches content from Google's official Generative Language API (generativelanguage.googleapis.com) to generate slide images. This is a well-known and trusted service. - [COMMAND_EXECUTION]: The skill includes automation scripts for deck scaffolding (
scripts/scaffold_deck.py) and skill installation (scripts/install_local.sh). These perform expected file system operations and directory management to integrate the skill into the user's environment. - [PROMPT_INJECTION]: The skill processes external markdown and JSON content specifications through
scripts/generate_image_deck.pyto create prompts for AI image generation. This represents an indirect prompt injection surface. - Ingestion points: Markdown or JSON files provided via the
--contentargument inscripts/generate_image_deck.py. - Boundary markers: The script parses sections but does not implement specific 'ignore' instructions for embedded content.
- Capability inventory: The script performs network POST requests to the Gemini API and writes image files to the local disk.
- Sanitization: Implements basic slugification for filenames but passes content directly into prompt templates.
Audit Metadata