kelly-scale-pptx
Pass
Audited by Gen Agent Trust Hub on Jul 8, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local shell scripts and Node.js commands to manage the application lifecycle. This includes starting a local Hono server on 127.0.0.1 and running utility scripts for PPTX generation (e.g.,
generate_pptx.ts). - [EXTERNAL_DOWNLOADS]: The
app/start.shscript installs required Node.js dependencies from the public NPM registry if they are not already present. This is a standard setup procedure for local applications and targets well-known packages. - [DATA_EXPOSURE]: The skill manages project data and configurations locally within the
app/.data/directory. The local server implementation includes path normalization checks to prevent directory traversal and restricts access to sensitive data folders. - [SAFE]: Indirect prompt injection risks are mitigated by the primary workflow, which requires a human-in-the-loop review of slide cards before any PPTX generation occurs. The web UI also implements HTML escaping for content rendering.
Audit Metadata