light-slides
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill interacts with system utilities to provide document conversion and preview capabilities. Scripts such as scripts/to_pdf.py and scripts/thumbnail.py utilize subprocess.run to invoke soffice (LibreOffice) and pdftoppm (Poppler). These calls are structured using argument lists, which effectively prevents shell command injection, and are used solely for the documented purpose of format conversion.
- [EXTERNAL_DOWNLOADS]: For its image-generation features, the skill performs network requests to well-known AI service endpoints including api.openai.com, generativelanguage.googleapis.com, and ark.cn-beijing.volces.com. It also downloads resulting image assets from URLs provided by these services. These operations are essential to the skill's functionality and target reputable technology providers.
- [SAFE]: The skill follows secure data handling practices by using yaml.safe_load for configuration parsing and relying on environment variables for API key management. No patterns associated with prompt injection, data exfiltration, or persistence were detected.
Audit Metadata