skills/lora-sys/skills/open-ppt/Gen Agent Trust Hub

open-ppt

Pass

Audited by Gen Agent Trust Hub on Sep 10, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill orchestrates its export and QA workflow by invoking system commands through Python's subprocess module and Node.js's child_process. In scripts/export_pptx.py, the run_command helper is used to verify the local environment (Node.js, NPM, Python) and install necessary tools. The Node.js exporter also utilizes spawnSync to safely parse YAML files using a Python fallback when native parsers are unavailable.
  • [EXTERNAL_DOWNLOADS]: To ensure functionality across different environments, the skill manages several dependencies at runtime. It installs the agent-browser package globally via NPM if not found, and uses pip install --user to fetch pyyaml, pillow, and websocket-client from official registries. Additionally, the export script supports fetching remote image assets if they are referenced by a presentation's manifest.
  • [DYNAMIC_EXECUTION]: The skill relies on dynamic execution to perform high-fidelity exports. It executes a local WebAssembly binary (pptd_wasm_bg.wasm) to handle the conversion of the PPTD format into valid PPTX files. Furthermore, it uses the Chrome DevTools Protocol (CDP) to execute JavaScript snippets within a headless browser instance for automating export dialogs and capturing page screenshots for the multimodal visual review process.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 10, 2026, 12:59 AM
Security Audit — agent-trust-hub — open-ppt