The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes functions that use subprocess.run to call system tools like libreoffice and convert. These implementations use argument arrays, which is a secure practice to avoid shell-related vulnerabilities.
[EXTERNAL_DOWNLOADS]: The instructions include the installation of established libraries such as python-pptx, pandas, and official Google API clients. These are standard dependencies for the stated functionality.
[CREDENTIALS_UNSAFE]: The skill demonstrates the use of GitHub Actions secrets (e.g., ${{ secrets.API_KEY }}) for handling sensitive information. This is a recommended security practice for CI/CD environments.
[PROMPT_INJECTION]: The skill processes data from external sources (CSV, JSON, Google Slides API). While this creates a surface for indirect prompt injection, the code examples use standard library methods for data handling, and the impact is confined to the content of the generated slides.

presentation-automation