The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses child_process.execSync to execute shell commands, specifically curl for downloading images and mkdir for workspace setup as described in SKILL.md and IMAGE_GUIDE.md.
[DYNAMIC_EXECUTION]: The core workflow involves generating JavaScript code at runtime and executing it using the Node.js runtime to create the presentation files.
[EXTERNAL_DOWNLOADS]: The skill instructs the agent to download images from external URLs found during web searches and to install the pptx-automizer package from the public npm registry.
[INDIRECT_PROMPT_INJECTION]: The skill defines a workflow where image URLs are discovered via web search and then directly interpolated into a shell command. The lack of validation for these URLs could allow a malicious web page to trigger command injection.
Ingestion points: Image URLs are sourced from external web search results and page fetching.
Capability inventory: The skill utilizes execSync for shell execution and has file system write capabilities.
Boundary markers: No delimiters or instructions to ignore embedded instructions within fetched content are provided.
Sanitization: No logic is present to sanitize or escape the external URLs before they are executed in the shell.

single-slide-ppt