The Agent Skills Directory

[DYNAMIC_EXECUTION]: The orchestrator in masters/index.js dynamically loads modules using require() with a template literal string (./patterns/${name}). The name variable is derived from the slide definitions provided at runtime. This pattern is vulnerable to path traversal attacks if an adversary can influence the pattern name to point to arbitrary JavaScript files on the filesystem (e.g., using ../ sequences), leading to unauthorized code execution through the build script generated by the agent.
[COMMAND_EXECUTION]: Several components, including masters/html2pptx.js and masters/examples/process-flow-diagram.js, utilize playwright-core to launch a headless Chromium browser instance. This involves executing a browser process on the host machine to render HTML content or rasterize icons. This capability increases the attack surface as the browser could be directed to navigate to local files or internal network resources if inputs are not strictly validated.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest a user-provided "brief" and structured data to determine the deck's narrative and content.
Ingestion points: The brief enters the agent's context during the planning phase described in SKILL.md.
Boundary markers: There are no technical boundaries or instructions to the agent to treat the brief content as data only, lacking delimiters like XML tags or explicit warnings to ignore embedded instructions.
Capability inventory: The skill possesses significant capabilities, including file system writes via pptx.writeFile, browser automation via Playwright, and the ability to perform web searches for market data.
Sanitization: The skill lacks a sanitization layer for the input brief, creating a risk that malicious instructions embedded in the brief could influence the agent to exfiltrate data, bypass design rules, or generate malicious content.
[EXTERNAL_DOWNLOADS]: While the skill primarily uses local files, the instructions in SKILL.md encourage the agent to perform web searches for market data and benchmarks. This ingestion of external, untrusted content from the internet contributes to the indirect prompt injection risk and potentially exposes the agent to malicious web content.

deck-design-ppt