The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill dynamically installs the Node.js package pptxgenjs@4.0.1 at runtime using npm install to support PowerPoint export functionality (located in tools/src/html_deck/setup_export_runtime.py). While NPM and this package are well-known, runtime installation is an external dependency vector.
[COMMAND_EXECUTION]: The skill makes extensive use of subprocess.run() to orchestrate various tools, including draw.io for SVG conversion, node for PPTX generation, and playwright for slide auditing. Binaries are resolved through environment variables or standard system paths.
[INDIRECT_PROMPT_INJECTION]: The skill has a high ingestion surface as it is designed to read untrusted external materials (Microsoft Word, Excel, Markdown files, and URLs) to generate storyboard 'claims' and slide content. While agents/deck-fixer.md includes safety instructions for the sub-agent to distinguish user comments from shell commands, the automated interpolation of external data into the agent context constitutes a known vulnerability surface.
[DYNAMIC_EXECUTION]: The auditing tool (check_deck.py) executes custom JavaScript within a headless Chrome instance via Playwright to perform DOM measurements. Additionally, export_pptx.py executes a Node.js script to process generated data into a presentation format.

html-deck