The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's primary mechanism involves the AI agent dynamically generating Python scripts that incorporate user-provided content (such as slide titles and bullet points) and executing them via uv run. This design pattern allows untrusted external input to directly influence the executable code path, creating a high risk of arbitrary code execution.
[COMMAND_EXECUTION]: The suggested workflow for executing generated scripts uses shell heredocs (<< 'EOF') without any provided guidance for sanitizing user-supplied data. A malicious user could provide input designed to break out of the heredoc or Python string literals to execute arbitrary shell commands on the host system.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data from multiple sources and processes it without security guardrails.
Ingestion points: Slide content provided in user prompts and brand-specific configuration files such as brand.json and tone-of-voice.md.
Boundary markers: Absent. The instructions do not define delimiters or provide warnings to the agent to ignore potentially malicious instructions embedded in the user data.
Capability inventory: The skill has the capability to execute arbitrary Python code, run shell commands (libreoffice, rm), and perform file system operations (read and write).
Sanitization: Absent. The skill lacks instructions for escaping, validating, or filtering external content before it is interpolated into prompts or executable code.
[DATA_EXPOSURE]: The skill relies on user-configurable output paths defined in config.json. The output.directory parameter could be manipulated to write files to sensitive locations on the file system, potentially leading to unauthorized file creation or the overwriting of system files if the execution environment is not strictly sandboxed.

pptx-generator