dashi-ppt
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill manages its own lifecycle and dependencies through standard Node.js package management and browser automation tools.
scripts/render_goal_deck.shexecutesnpm installandplaywright-core installto provision the local runtime environment.scripts/check_latest_version.mjsretrieves version metadata from trusted domains includingregistry.npmjs.org,registry.npmmirror.com, andraw.githubusercontent.com.- [COMMAND_EXECUTION]: The skill relies on local script execution to transform content plans into presentations and perform media processing.
- Multiple scripts in
project/scripts/are used to run Node.js processes for layout inspection, media staging, and presentation rendering. - The system integrates external binaries such as OpenSSL for local certificate generation and FFmpeg for video processing, all within the context of the local project directory.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text to generate presentation content, which could serve as a vector for injection attacks.
- Ingestion points: User data is captured in the
goal.jsonfile and injected into template properties or bespoke compositions. - Boundary markers: Content is handled within structured JSON fields and validated against layout-specific contracts to ensure data remains separate from layout logic.
- Capability inventory: The skill uses local bundling (esbuild) and headless browser rendering (Playwright) to produce its final output.
- Sanitization:
project/scripts/validate-goal-spec.mjsimplements rigorous checks, such asvalidateFreeHtml, to strip dangerous tags and malicious URL schemes (e.g.,javascript:) from user-provided content. - [DYNAMIC_EXECUTION]: The skill dynamically assembles presentation code and executes logic in a controlled browser environment for exports.
project/src/renderDeck.jsxusesesbuild.buildSyncto bundle theme-specific runtimes for the final deck.- Export functionalities in
project/scripts/export-pptx.mjslaunch a headless Chromium instance via Playwright to render the PPT HTML and generate PDF or PPTX files.
Audit Metadata