pptx

Fail

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: HIGHDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The script scripts/office/soffice.py contains logic to compile a C-based socket shim at runtime using gcc and inject it into the application environment via the LD_PRELOAD environment variable.
  • Evidence: subprocess.run(["gcc", "-shared", "-fPIC", "-o", str(_SHIM_SO), str(src), "-ldl"], ...) and env["LD_PRELOAD"] = str(shim).
  • Purpose: This mechanism is designed to handle environments where AF_UNIX sockets are restricted, facilitating the operation of LibreOffice in restricted or sandboxed environments.
  • [INDIRECT_PROMPT_INJECTION]: The skill operates on untrusted PowerPoint (.pptx) files and facilitates a workflow where slide content is rendered to images and subsequently analyzed by subagents, creating a surface for indirect instructions to reach the AI.
  • Ingestion points: Content is ingested from user-supplied .pptx files via scripts/office/unpack.py and visualized using scripts/thumbnail.py or converted via soffice and pdftoppm.
  • Boundary markers: Absent. The instructions for visual QA do not provide delimiters or specific "ignore instructions within content" warnings for the subagents processing the slide images.
  • Capability inventory: The skill scripts have the capability to execute arbitrary shell commands via subprocess.run (e.g., in thumbnail.py and soffice.py) and perform extensive file system modifications.
  • Sanitization: While XML parsing uses defusedxml to mitigate XML-based attacks, there is no evidence of filtering or sanitizing text content from slides that could influence the reasoning of subagents during the visual inspection loop.
  • [COMMAND_EXECUTION]: The skill relies heavily on executing external CLI tools via subprocess.run to perform its primary tasks.
  • scripts/thumbnail.py: Executes soffice (LibreOffice) for PDF conversion and pdftoppm for image generation.
  • scripts/office/soffice.py: Executes gcc for shim compilation and soffice for office operations.
  • scripts/office/validators/redlining.py: Executes git diff for comparing text content.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Sep 15, 2026, 02:40 PM