The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/analyze_pptx.py executes external binaries using subprocess.run. It specifically attempts to locate and run soffice (LibreOffice) or libreoffice for PDF conversion, and qlmanage on macOS for image generation. These calls use a list of arguments rather than a shell string, which is a security best practice that helps prevent command injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: When the --with-gemini flag is used, the skill sends extracted slide text and images to the Google Gemini API for analysis. This is a documented feature and requires a user-provided GEMINI_API_KEY or GOOGLE_API_KEY to be set in the environment variables.
[DATA_EXFILTRATION]: While the skill processes local PowerPoint files and can send data to the Gemini API, it does not show any signs of unauthorized data exfiltration. The communication is limited to the official Google Generative AI service as part of its intended functionality.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted PowerPoint files and interpolates extracted text directly into prompts sent to an LLM (Gemini). While there is a potential for a malicious file to contain instructions designed to manipulate the analysis results, the impact is low as it only affects the output of that specific analysis task.

pptx-analyzer