skills/che626/competition-ppt-template-first-skill/competition-ppt-template-first/Gen Agent Trust Hub
competition-ppt-template-first
Pass
Audited by Gen Agent Trust Hub on Jul 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The documentation and utility scripts refer to
npx -y skills@latest, which fetches and runs theskillspackage from the official npm registry. This is a standard procedure for installation and validation within the supported agent environment. - [COMMAND_EXECUTION]: The package includes a PowerShell script
scripts/validate-distribution.ps1designed for maintainers to verify the skill's discoverability. It executes thenpx skills addcommand locally to confirm that the skill's manifest and metadata are correctly formatted for the platform. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it is designed to ingest and process user-supplied reports, evidence, and project data.
- Ingestion points: Technical reports, screenshots, and source documents provided by the user (referenced in
SKILL.mdandexamples/prompt-recipes.md). - Boundary markers: The instructions do not define specific delimiters for untrusted data, but they require the agent to create a structured
fact-registry.mdto ground all claims in verified material. - Capability inventory: The agent possesses file system write capabilities to create the project's folder structure and generate the PowerPoint content.
- Sanitization: No explicit sanitization or filtering of input text is mentioned, though the 'template-first' principle inherently structures the output to match predefined visual archetypes.
Audit Metadata