The Agent Skills Directory

[SAFE]: No malicious behavior, obfuscation, or unauthorized access to sensitive local resources was detected. The skill's logic is consistent with its stated purpose of managing Google Slides presentations through a vendor-provided gateway.
[COMMAND_EXECUTION]: The documentation provides executable Python and JavaScript snippets that use standard networking libraries to interact with the vendor's API. These are intended for implementation by the agent to fulfill user requests.
[DATA_EXFILTRATION]: The skill utilizes the MATON_API_KEY environment variable for authentication with vendor-owned domains (gateway.maton.ai, ctrl.maton.ai, connect.maton.ai). This represents standard functional behavior for the integrated service and does not constitute unauthorized exfiltration.
[INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection as it processes untrusted user data for slide content without explicit sanitization. 1. Ingestion points: Slide titles, text, and image URLs defined in API snippets in SKILL.md. 2. Boundary markers: No delimiters or specialized instructions are present to distinguish between commands and data in the payloads. 3. Capability inventory: The skill utilizes network operations via urllib.request and requests. 4. Sanitization: No explicit sanitization or validation of external content is performed before interpolation into API requests.

google-slides