dashi-ppt

Pass

Audited by Gen Agent Trust Hub on Sep 13, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill manages its own lifecycle and dependencies through standard Node.js package management and browser automation tools.
  • scripts/render_goal_deck.sh executes npm install and playwright-core install to provision the local runtime environment.
  • scripts/check_latest_version.mjs retrieves version metadata from trusted domains including registry.npmjs.org, registry.npmmirror.com, and raw.githubusercontent.com.
  • [COMMAND_EXECUTION]: The skill relies on local script execution to transform content plans into presentations and perform media processing.
  • Multiple scripts in project/scripts/ are used to run Node.js processes for layout inspection, media staging, and presentation rendering.
  • The system integrates external binaries such as OpenSSL for local certificate generation and FFmpeg for video processing, all within the context of the local project directory.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text to generate presentation content, which could serve as a vector for injection attacks.
  • Ingestion points: User data is captured in the goal.json file and injected into template properties or bespoke compositions.
  • Boundary markers: Content is handled within structured JSON fields and validated against layout-specific contracts to ensure data remains separate from layout logic.
  • Capability inventory: The skill uses local bundling (esbuild) and headless browser rendering (Playwright) to produce its final output.
  • Sanitization: project/scripts/validate-goal-spec.mjs implements rigorous checks, such as validateFreeHtml, to strip dangerous tags and malicious URL schemes (e.g., javascript:) from user-provided content.
  • [DYNAMIC_EXECUTION]: The skill dynamically assembles presentation code and executes logic in a controlled browser environment for exports.
  • project/src/renderDeck.jsx uses esbuild.buildSync to bundle theme-specific runtimes for the final deck.
  • Export functionalities in project/scripts/export-pptx.mjs launch a headless Chromium instance via Playwright to render the PPT HTML and generate PDF or PPTX files.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 13, 2026, 01:41 PM