ppt-upgrade

Pass

Audited by Gen Agent Trust Hub on Jul 9, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the npx skills command to perform management tasks such as adding, removing, and updating skill sets. These commands are executed based on a predefined catalog and deprecation list provided within the skill, and the workflow requires explicit user confirmation before any changes are applied.
  • [EXTERNAL_DOWNLOADS]: Fetches and installs updates from the author's repository (LilMGenius/paperthin). This is the primary function of the skill and follows standard practices for skill distribution and updates.
  • [DATA_EXFILTRATION]: Includes an optional step to star the GitHub repository via the gh api command. This action is only performed with explicit user consent and uses the official GitHub CLI tool.
  • [PROMPT_INJECTION]: The skill parses the output of the npx skills list command to identify installed skills. To prevent potential issues with malicious or malformed skill names, it cross-references all detected items against a hardcoded whitelist ('Current catalog'), ensuring it only interacts with recognized components.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 9, 2026, 06:36 AM
Security Audit — agent-trust-hub — ppt-upgrade