pptx
Warn
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script scripts/office/soffice.py performs runtime compilation and library injection. It writes a C source string for a socket shim to a temporary location, executes gcc to compile it into a shared object, and sets the LD_PRELOAD environment variable to shim LibreOffice network operations.
- [EXTERNAL_DOWNLOADS]: Instructions in SKILL.md suggest runtime installation of well-known dependencies such as pptxgenjs, react-icons, sharp, and markitdown if they are not already present in the environment.
- [PROMPT_INJECTION]: The skill processes untrusted user-supplied .pptx files, creating a surface for indirect prompt injection. 1. Ingestion points: .pptx files are extracted and parsed in multiple scripts including scripts/add_slide.py and scripts/office/validators/pptx.py. 2. Boundary markers: No specific delimiters or instructions are used to ignore embedded commands in the slide XML. 3. Capability inventory: The skill can execute shell commands (gcc, soffice, pdftoppm, git), write files, and modify archive structures. 4. Sanitization: Use of the defusedxml library provides protection against XML external entity attacks.
Audit Metadata