The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes subprocess.run to invoke system utilities like soffice, pdftoppm, and git for document conversion, thumbnail generation, and text comparison.
These operations are essential for the skill's primary purpose of presentation processing.
Command arguments are constructed using validated file paths or internal script logic, which mitigates the risk of command injection.
[SAFE]: The skill demonstrates strong security posture by implementing protections against common file-processing vulnerabilities.
It uses the defusedxml library for parsing OOXML files, which prevents XML External Entity (XXE) and billion laughs attacks.
The archive extraction logic in unpack.py includes explicit path validation to prevent ZipSlip (path traversal) vulnerabilities.
Playwright is used in a local-only capacity to render HTML slides for conversion to PPTX, avoiding external network exposure.

pptx-official