ppt-generator
Pass
Audited by Gen Agent Trust Hub on Aug 5, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues detected. The skill performs a legitimate task of text-to-HTML conversion.
- [EXTERNAL_DOWNLOADS]: The skill references assets from well-known and reputable CDNs.
- Fetches the TailwindCSS library from ByteDance's public CDN (
lf26-cdn-tos.bytecdntp.com). - Loads fonts from established mirrors such as Bilibili's static asset domain (
s1.hdslb.com) and theloli.netfont service. - [INDIRECT_PROMPT_INJECTION]: The skill provides a surface for processing untrusted user data (the speech script) into generated code.
- Ingestion points: The user's input lecture/speech script is read in
SKILL.md(Step 1). - Boundary markers: Not explicitly defined in the instructions.
- Capability inventory: The skill only generates HTML code output and does not possess capabilities for subprocess execution, file system writes, or network requests.
- Sanitization: While not explicitly defined, the multi-step "refinement" and "distillation" instructions (Steps 2 and 3) naturally involve the agent transforming and summarizing the content, which mitigates the risk of direct injection of malicious scripts into the final HTML output.
Audit Metadata