dashi-ppt
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: Instructions in SKILL.md allow for integrating design guidance from an external skill (baoyu-design), which represents a surface for indirect prompt injection via design parameters.
- [COMMAND_EXECUTION]: The skill's instructions mandate the execution of a version check script (scripts/check_latest_version.mjs) at the end of each task to notify users of updates.
- [COMMAND_EXECUTION]: Local system utilities including ffmpeg, openssl, and sips are invoked via Node.js spawn and execFileSync to handle video processing, security certificate generation, and image downscaling.
- [COMMAND_EXECUTION]: A local HTTP/HTTPS server is initiated by scripts/serve-preview-https.mjs to host the generated presentations. The server includes Origin-based authentication to restrict access from unauthorized sources.
- [EXTERNAL_DOWNLOADS]: The skill verifies network availability by pinging NPM registries during the installation phase in scripts/ensure-registry.mjs.
- [EXTERNAL_DOWNLOADS]: Export functionality utilizes playwright-core, which typically downloads headless browser binaries to the local machine during initialization.
Audit Metadata