deck-design-pdf
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill's architecture is self-contained. It vendors trusted third-party libraries including ECharts (visualization), Tailwind CSS (styling), and Font Awesome (icons) within its own directory structure to avoid external network dependencies during the build process.
- [SAFE]: The rendering pipeline in
engine/render.jsutilizes Playwright (Chromium) to perform HTML-to-PDF conversion. This is a legitimate and standard implementation for high-fidelity document generation. - [SAFE]: Systematic scanning for prompt injection, hardcoded credentials, and data exfiltration patterns yielded no results. The instructions focus exclusively on presentation design methodology and technical implementation.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided data and storyboards to populate slides. While this creates a surface for data-driven content generation, the risk is mitigated as the final output is a static PDF rendered in a local environment. This behavior is fundamental to the skill's primary purpose.
- [DYNAMIC_EXECUTION]: The workflow involves generating Node.js build scripts and HTML/JavaScript code for charts. This dynamic generation is a necessary feature for the "deck-as-code" approach and operates within the user's local context using the provided engine.
Audit Metadata