deck-kit
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill's export and maintenance utilities execute local commands using
nodeandffmpeg. These are used for tasks such as linting deck content (node deck.mjs check), checking performance, and encoding video files. - [EXTERNAL_DOWNLOADS]: The
bundlefunction inexport/deck.mjsis designed to fetch external assets, including Google Fonts and library scripts from well-known CDNs like jsDelivr. This feature allows users to generate self-contained, offline-compatible versions of their presentations. - [DYNAMIC_EXECUTION]: The exporter leverages
playwright-coreto launch a headless browser and render the presentation. It executes the core animation runtime (deck.js) and any user-defined JavaScript within the browser context to capture rest frames and transitions. - [SAFE]: Analysis of the skill's dependencies and source code confirms that all operations are consistent with its primary purpose as a presentation generation tool. No suspicious obfuscation, hardcoded credentials, or unauthorized data access patterns were found.
Audit Metadata