create-slides

Pass

Audited by Gen Agent Trust Hub on Jul 31, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The assets/tools/fonts.mjs script performs network requests to fonts.googleapis.com and fonts.google.com to fetch webfonts and CSS. These fonts are then inlined into the deck as Base64 data URIs to ensure offline functionality. This uses well-known, trusted services for their intended purpose.
  • [COMMAND_EXECUTION]: Several utility scripts execute external binaries via node:child_process. assets/tools/qa.mjs and assets/tools/export-pdf.mjs use Playwright (which launches Chromium), while assets/tools/record.mjs and assets/tools/audit-video.mjs execute ffmpeg and ffprobe to process and verify video exports.
  • [COMMAND_EXECUTION]: The assets/tools/record.mjs script dynamically generates a temporary bash script to act as an encoder shim for Playwright. This shim intercepts ffmpeg calls to apply custom encoding settings (e.g., lossless 4:4:4 H.264) for superior video quality, which is a documented and legitimate architectural choice for this toolchain.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 31, 2026, 07:48 AM
Security Audit — agent-trust-hub — create-slides