codex-ppt-skill
Pass
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill's behavior is consistent with its stated purpose of automating the creation of PowerPoint presentations.
- [COMMAND_EXECUTION]: The skill uses Python scripts (codex_ppt_runtime.py and assemble_ppt.py) to manage image generation and to package the final presentation file. These are standard operations for a development and productivity tool.
- [CREDENTIALS_UNSAFE]: The skill requires an OpenAI API key for operation. It follows standard security practices by instructing users to store the key in a local .env file within the application's configuration directory (~/.codex-ppt-skill/.env).
- [EXTERNAL_DOWNLOADS]: The skill components are downloaded from a public GitHub repository (ningzimu/codex-ppt-skill).
- [PROMPT_INJECTION]: The skill processes external text sources (articles, papers), creating an ingestion point for untrusted data.
- Ingestion points: Text content from user-provided documents like articles and reports.
- Boundary markers: No specific boundary markers or instructions to ignore embedded commands are included in the prompt construction logic.
- Capability inventory: The skill has access to local file system writes and can execute pre-defined Python scripts.
- Sanitization: The skill does not explicitly describe any sanitization of the input text before processing.
Audit Metadata