The Agent Skills Directory

Opt-in Custom Code Execution: The build_deck.py script allows for the execution of slide-specific Python scripts (content-extra.py) to handle complex drawings.
Evidence: Found in scripts/build_deck.py, which uses importlib to load and execute these modules.
Consideration: While this is disabled by default and requires the --allow-scripts flag, and despite the implementation of an AST-based lint to block dangerous modules, the documentation correctly notes that this is not a robust security boundary. Users should only authorize scripts from trusted sources.
Large Binary Parser Surface Area: The skill relies on LibreOffice and MuPDF (via PyMuPDF) to handle PPTX and PDF conversions.
Evidence: Scripts like scripts/export_slides.py and scripts/export_svg.py invoke soffice (LibreOffice) and PyMuPDF.
Consideration: Complex C/C++ parsers like these have a history of memory-safety vulnerabilities. The skill includes a scripts/pdf_safety.py layer to enforce file size and page count limits, which serves as a good defense-in-depth measure, but the underlying risk of parsing untrusted documents remains.
Indirect Prompt Injection Surface: The validate_slides.py script sends rendered slide images and a validation prompt to an external vision model via the Copilot SDK.
Evidence: Logic implemented in scripts/validate_slides.py.
Consideration: If a deck is generated from untrusted data, that data could contain visual text or metadata designed to influence the vision model's evaluation or the agent's next steps in a pipeline.
Subprocess Command Execution: Multiple scripts use the subprocess module to coordinate external tools.
Evidence: scripts/export_slides.py and scripts/export_svg.py execute shell commands for conversion.
Consideration: The skill uses argument lists rather than shell strings, which mitigates standard command injection. However, the execution depends on external binaries (soffice, uv, pdftoppm) being present on the host system.
External Tool Management: The skill's orchestrator scripts automatically download and use uv for environment management.
Evidence: scripts/Invoke-PptxPipeline.ps1 and scripts/invoke-pptx-pipeline.sh.
Consideration: While uv is a well-known tool, the automated setup of virtual environments involves fetching packages from external registries (PyPI).

powerpoint