ppt-slide-generator
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The script
scripts/gdrive.pyreads~/.clasprc.jsonto extract sensitive Google OAuth tokens (refresh_token, client_id, and client_secret). This is used to facilitate the Google Slides export functionality but involves accessing local credential files. - [COMMAND_EXECUTION]: The skill executes shell commands to run dynamically generated Python scripts (
render-pdf.py,screenshot-slides.py) and uses system commands likestartto open files for the user. - [EXTERNAL_DOWNLOADS]: The skill fetches fonts from Google Fonts and references JavaScript libraries including
html2canvas@1.4.1andjspdf@2.5.2from the jsDelivr CDN to enable browser-based PDF generation. - [DYNAMIC_EXECUTION]: The agent is instructed to generate and execute local Python scripts at runtime to perform PDF rendering via Playwright and to capture slide screenshots for quality review.
- [INDIRECT_PROMPT_INJECTION]: The skill performs automated web research and ingests external data to populate slide content. While it includes approval gates for the outline and detailed content, the ingestion of unvalidated external data into the generated HTML presents a standard low-risk injection surface.
Audit Metadata