pptx
Pass
Audited by Gen Agent Trust Hub on Jun 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
subprocess.runfunction in several scripts (thumbnail.py,pack.py,redlining.py) to call external system utilities includingsoffice,pdftoppm, andgit. These calls are implemented using list-based argument passing rather than shell strings, which effectively prevents shell injection vulnerabilities. - [EXTERNAL_DOWNLOADS]: Instructions are provided for the installation of well-known third-party dependencies from standard registries, including
Playwright,Sharp,PptxGenJS, andLibreOffice. These resources are established tools within the document processing and web automation ecosystems. - [SAFE]: The skill demonstrates secure coding practices by using the
defusedxmllibrary for all XML parsing operations. This proactively mitigates risks associated with XML External Entity (XXE) attacks, which are a common concern when processing Office Open XML (OOXML) formats.
Audit Metadata