deck-craft

Pass

Audited by Gen Agent Trust Hub on Jul 22, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill includes a shell script (scripts/install_fonts.sh) that fetches official Noto Sans and Noto Serif fonts from Google's public GitHub repository (raw.githubusercontent.com/google/fonts). This is a documented environmental setup step to ensure high-quality typography in the generated decks.
  • [COMMAND_EXECUTION]: The render QA process (scripts/render_qa.py) utilizes subprocess.run to invoke local system utilities, specifically soffice (from LibreOffice) and pdftoppm (from Poppler). These tools are used to convert the generated .pptx files into PDF and then into image previews for visual verification by the user or agent.
  • [EXTERNAL_DOWNLOADS]: The documentation (references/humanize.md and SKILL.md) recommends enhancing text refinement capabilities by installing the Humanizer-zh skill from a third-party GitHub repository (github.com/op7418/Humanizer-zh) using platform-specific commands. This is an optional recommendation for the agent to extend its own feature set.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 22, 2026, 03:01 PM
Security Audit — agent-trust-hub — deck-craft