The Agent Skills Directory

[SAFE]: The skill performs legitimate operations for PowerPoint generation and quality assurance. All scripts and libraries are dedicated to the stated purpose of building, modifying, and verifying PPTX decks.
[COMMAND_EXECUTION]: The render-qa.mjs script utilizes node:child_process.spawnSync to invoke local binaries like soffice (LibreOffice) and pdftoppm (Poppler) to facilitate PPTX to PDF/JPG conversion for visual QA. These calls are constrained to specific, necessary tools and do not accept arbitrary user-controlled command strings.
[EXTERNAL_DOWNLOADS]: The ai-image.js library handles network communication with official AI service endpoints (such as OpenAI, Google, and MiniMax) for image generation. The script correctly handles API keys through environment variables and implements graceful degradation when keys are missing.
[CREDENTIALS_UNSAFE]: No hardcoded secrets or sensitive credentials were detected. The skill provides clear instructions for users to manage their own API keys via environment variables or .env files, which is a standard and secure practice for development tools.
[DATA_EXFILTRATION]: While the skill accesses the local file system and makes network requests, these operations are restricted to generating presentation assets and communicating with authorized AI providers. There is no evidence of attempts to harvest or exfiltrate sensitive files (e.g., SSH keys, cloud credentials) to unauthorized destinations.

themed-cn-pptx