make-deck
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses Bash for local environment discovery and file operations, including searching for design systems in the user's
~/.claude/directory and managing template assets viacpandmkdir. - [DYNAMIC_EXECUTION]: Implements a layout verification step using
mcp__chrome-devtools__evaluate_scriptto run an automated overflow audit within the browser context to measure slide element dimensions. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from multiple external sources, including local documents, GitHub repositories, Figma URLs, and screenshots, which are used to generate deck content.
- Ingestion points: Phase 0 (Auto-detect) reads local project files and triggers ingestion skills for external URLs and attachments.
- Boundary markers: No specific delimiters or safety instructions are defined for the processed content within the instructions.
- Capability inventory: Possesses file-writing capabilities, shell access for file management, and browser script execution.
- Sanitization: The skill does not explicitly describe sanitizing or escaping the external content before using it to generate the deck artifacts.
Audit Metadata