competition-ppt-template-first

Pass

Audited by Gen Agent Trust Hub on Jul 12, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The documentation and utility scripts refer to npx -y skills@latest, which fetches and runs the skills package from the official npm registry. This is a standard procedure for installation and validation within the supported agent environment.
  • [COMMAND_EXECUTION]: The package includes a PowerShell script scripts/validate-distribution.ps1 designed for maintainers to verify the skill's discoverability. It executes the npx skills add command locally to confirm that the skill's manifest and metadata are correctly formatted for the platform.
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it is designed to ingest and process user-supplied reports, evidence, and project data.
  • Ingestion points: Technical reports, screenshots, and source documents provided by the user (referenced in SKILL.md and examples/prompt-recipes.md).
  • Boundary markers: The instructions do not define specific delimiters for untrusted data, but they require the agent to create a structured fact-registry.md to ground all claims in verified material.
  • Capability inventory: The agent possesses file system write capabilities to create the project's folder structure and generate the PowerPoint content.
  • Sanitization: No explicit sanitization or filtering of input text is mentioned, though the 'template-first' principle inherently structures the output to match predefined visual archetypes.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 12, 2026, 10:56 AM
Security Audit — agent-trust-hub — competition-ppt-template-first