pptx
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Several Python scripts (
thumbnail.py,pack.py,redlining.py) use thesubprocessmodule to invoke external tools likesoffice(LibreOffice),pdftoppm(Poppler), andgit. These calls are restricted to specific, non-shell command strings and are necessary for the skill's primary functionality of slide conversion and document validation. - [EXTERNAL_DOWNLOADS]: The skill requires standard third-party libraries for its operations, including
playwright,pptxgenjs, andsharp(Node.js) andmarkitdownanddefusedxml(Python). These are well-known packages for presentation and document processing. - [INDIRECT_PROMPT_INJECTION]: As the skill is designed to analyze and extract text from user-provided
.pptxfiles, it possesses an inherent attack surface where malicious content within a presentation could attempt to influence the agent's behavior. However, the skill utilizes structured processing and extraction scripts that reduce the risk of accidental instruction obedience.
Audit Metadata