deck-generator
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
scripts/generate-deck.pyscript makes network requests togenerativelanguage.googleapis.comto fetch AI-generated image data. This utilizes a well-known and trusted service provider for the skill's core functionality. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied or agent-generated slide content which is then used as input for the image generation API.
- Ingestion points: Slide titles and prompts are read from the
slides.jsonfile inscripts/generate-deck.py. - Boundary markers: No specific delimiters or safety instructions are used to wrap the slide content before it is prepended with style prefixes.
- Capability inventory: The script performs network operations (POST requests to Google's API) and file system writes (saving PNG files to an output directory).
- Sanitization: No sanitization is applied to the slide content; however, the risk is negligible as the data is only used to generate visual image content and does not influence command execution or file system permissions.
Audit Metadata