The Agent Skills Directory

[SAFE]: The skill employs well-known, legitimate Node.js libraries (pptxgenjs, puppeteer, cheerio) for its core functionality of converting HTML to PPTX.
[EXTERNAL_DOWNLOADS]: The skill downloads standard dependencies from the NPM registry and the Chromium binary required by Puppeteer. These are standard operations for the tool's intended purpose.
[COMMAND_EXECUTION]: Shell command usage is restricted to standard script execution via node and installation via npm, with no evidence of privilege escalation or arbitrary execution.
[DATA_EXFILTRATION]: The script can fetch content from URLs provided by the user, which is a core feature for converting web pages. There is no evidence of unauthorized network requests or exfiltration of sensitive local data.
[PROMPT_INJECTION]: Indirect Prompt Injection Surface
Ingestion points: The scripts/html-to-pptx.js file accepts input from external URLs, local files, and stdin.
Boundary markers: The script does not use specific delimiters to isolate processed HTML content from agent instructions.
Capability inventory: The skill has capabilities to write files to the disk and render content via a headless browser (Puppeteer).
Sanitization: The script implements basic sanitization by removing <script> and <style> tags when using the default text-parsing mode, reducing the risk of executing malicious scripts embedded in the HTML.

html-to-pptx