html-to-pptx
Pass
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill automatically resolves and downloads font files from trusted well-known services, specifically Google Fonts (
fonts.googleapis.com) and official Google font repositories on GitHub. These downloads are performed to ensure consistent rendering across different systems. - [COMMAND_EXECUTION]: The skill utilizes shell commands to manage system-level dependencies. Specifically, it invokes
fc-cacheon Linux to refresh the font cache after installation and calls the LibreOffice binary (soffice) to render PowerPoint files into PDF for the visual audit stage. These operations are scoped to the skill's primary functionality and use localized paths. - [PROMPT_INJECTION]: The skill implements a 'Visual Audit' feature that generates a prompt for a sub-agent to analyze screenshots of the rendered HTML and PPTX content. While this creates a surface for indirect prompt injection if the source HTML contains adversarial visual content, the risk is mitigated by the highly structured nature of the audit prompt and the specialized role assigned to the sub-agent.
Audit Metadata