powerpoint
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill consistently uses the defusedxml library for parsing all XML-based PowerPoint and Word document components, protecting against XML External Entity (XXE) and other common XML vulnerabilities.
- [EXTERNAL_DOWNLOADS]: All external dependencies, such as markitdown, Pillow, and pptxgenjs, are reputable and well-known libraries from official registries.
- [COMMAND_EXECUTION]: Shell commands for document conversion and image generation use standard utilities like LibreOffice (soffice) and Poppler (pdftoppm), which are integral to the skill's primary function.
- [PROMPT_INJECTION]: The skill manages the risk of indirect prompt injection by structurally parsing slide data rather than executing content. 1. Ingestion points: Slide and relationship XML files are processed from user-provided PPTX files. 2. Boundary markers: Absent, but operations are restricted to structural manipulation. 3. Capability inventory: Includes local file writes and shell commands for document conversion. 4. Sanitization: All untrusted XML data is handled through the defusedxml parser.
Audit Metadata