skills/lc2panda/wps-mcp/wps-ppt/Gen Agent Trust Hub

wps-ppt

Pass

Audited by Gen Agent Trust Hub on Mar 25, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the wps_execute_method tool (with appType: "wpp") to perform a wide variety of presentation tasks, including creating files, adding shapes, inserting images, and managing animations. This constitutes a functional command execution interface for the WPS Office suite.
  • [DATA_EXFILTRATION]: The skill accesses document data and local metadata via wps_get_active_presentation, getSlideInfo, and getSlideNotes. While necessary for the skill's operation, this provides a surface for reading potentially sensitive content from open presentations.
  • [PROMPT_INJECTION]: The skill is subject to indirect prompt injection risks. Ingestion points: Data enters the context from active presentations via wps_get_active_presentation, getSlideInfo, getSlideNotes, getTextBoxes, and getPptTableCell (SKILL.md). Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present in the prompt templates. Capability inventory: The skill can modify documents and add external links using addSlide, addTextBox, insertPptImage, and addPptHyperlink (SKILL.md). Sanitization: No sanitization of ingested presentation content is performed.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 25, 2026, 04:03 AM