tech-slide
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The file
scripts/check_dependencies.pyincludes a print statement suggesting the installation of theuvtool using a piped shell command (curl -LsSf https://astral.sh/uv/install.sh | sh). This command targets a well-known service (Astral) and is provided as a user instruction rather than being executed automatically by the skill. - [COMMAND_EXECUTION]: The script
scripts/check_dependencies.pyusessubprocess.runto call theuvCLI tool. These calls are used for routine environment synchronization (uv sync) and version checking, which are standard operations for managing project dependencies. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process user-provided technical content to generate presentation slides, which introduces a surface for indirect prompt injection.
- Ingestion points: The agent modifies and processes
slides.mdbased on user-supplied information. - Boundary markers: The skill utilizes standard Markdown frontmatter and slide delimiters (
---) to structure content. - Capability inventory: The skill performs file copying (
cp), dependency syncing (uv sync), and slide rendering (npx slidev). - Sanitization: No specific input sanitization is implemented; the skill relies on the Slidev parser to handle the markdown content.
Audit Metadata