ppt-image-deck
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/inspect_pptx.pyusessubprocess.runto execute the system utilityfc-list. This is used to query the system for available font families to verify PPTX rendering compatibility. - [DYNAMIC_EXECUTION]: The script
scripts/merge_images_to_pptx.pyexecutes a local Node.js script (scripts/merge_images_to_pptx.mjs) by spawning a subprocess. The execution path for the Node binary and its modules is determined by the environment variablesCODEX_PRIMARY_RUNTIME_NODEandCODEX_PRIMARY_RUNTIME_NODE_MODULES. - [DYNAMIC_EXECUTION]: The JavaScript file
scripts/merge_images_to_pptx.mjsuses dynamicimportandcreateRequireto load the@oai/artifact-toolat runtime based on environment-defined paths. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process and analyze external "benchmark" documents, project data files, and industry references provided by the user.
- Ingestion points: Files like
project-truth.mdand user-supplied PDF/PPT reference files identified inbenchmark-selection.mdare ingested into the agent context. - Boundary markers:
SKILL.mdinstructs the agent to categorize data intoFACT,JUDGMENT,PROPOSAL, andUNKNOWNtags, which provides some structural separation between data and instructions. - Capability inventory: The skill possesses the ability to write files, generate images via external tools, and execute shell commands via the included Python and Node.js scripts.
- Sanitization: There is no explicit sanitization or escaping mentioned for the external content before it is processed by the agent's reasoning logic.
- [EXTERNAL_DOWNLOADS]: The documentation in
docs/INSTALLATION.mdprovides a link to download the skill source code from the author's GitHub repository (github.com/dacnay816y62-hub/FANTASY-ppt-1.git).
Audit Metadata