create-slides
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
assets/tools/fonts.mjsscript performs network requests tofonts.googleapis.comandfonts.google.comto fetch webfonts and CSS. These fonts are then inlined into the deck as Base64 data URIs to ensure offline functionality. This uses well-known, trusted services for their intended purpose. - [COMMAND_EXECUTION]: Several utility scripts execute external binaries via
node:child_process.assets/tools/qa.mjsandassets/tools/export-pdf.mjsuse Playwright (which launches Chromium), whileassets/tools/record.mjsandassets/tools/audit-video.mjsexecuteffmpegandffprobeto process and verify video exports. - [COMMAND_EXECUTION]: The
assets/tools/record.mjsscript dynamically generates a temporary bash script to act as an encoder shim for Playwright. This shim intercepts ffmpeg calls to apply custom encoding settings (e.g., lossless 4:4:4 H.264) for superior video quality, which is a documented and legitimate architectural choice for this toolchain.
Audit Metadata