ppt-slide-generator

Pass

Audited by Gen Agent Trust Hub on Aug 13, 2026

Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [CREDENTIALS_UNSAFE]: The script scripts/gdrive.py reads ~/.clasprc.json to extract sensitive Google OAuth tokens (refresh_token, client_id, and client_secret). This is used to facilitate the Google Slides export functionality but involves accessing local credential files.
  • [COMMAND_EXECUTION]: The skill executes shell commands to run dynamically generated Python scripts (render-pdf.py, screenshot-slides.py) and uses system commands like start to open files for the user.
  • [EXTERNAL_DOWNLOADS]: The skill fetches fonts from Google Fonts and references JavaScript libraries including html2canvas@1.4.1 and jspdf@2.5.2 from the jsDelivr CDN to enable browser-based PDF generation.
  • [DYNAMIC_EXECUTION]: The agent is instructed to generate and execute local Python scripts at runtime to perform PDF rendering via Playwright and to capture slide screenshots for quality review.
  • [INDIRECT_PROMPT_INJECTION]: The skill performs automated web research and ingests external data to populate slide content. While it includes approval gates for the outline and detailed content, the ingestion of unvalidated external data into the generated HTML presents a standard low-risk injection surface.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 13, 2026, 06:46 AM
Security Audit — agent-trust-hub — ppt-slide-generator