pptx-generator

Warn

Audited by Gen Agent Trust Hub on Jun 22, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill generates individual JavaScript files for each slide (e.g., slides/slide-01.js) and subsequently executes them via a central compile.js script using node. This process involves dynamic loading of generated code using require() with paths computed at runtime (e.g., require(./slide-${num}.js)).
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it is designed to analyze and extract text from untrusted, user-provided PowerPoint files using markitdown. Instructions embedded within the processed document metadata or content could potentially influence the agent's behavior.
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of external packages from public registries. This includes markitdown from Microsoft and the well-known pptxgenjs library, which are used to handle the core functionality of reading and generating presentation files.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jun 22, 2026, 02:17 PM
Security Audit — agent-trust-hub — pptx-generator