report-to-google-slides
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- Local File System Access: The skill is designed to process local HTML files and write outputs to a specified directory (typically
/tmp/report_to_google_slides). This behavior is consistent with its role as a report conversion tool. - Subprocess Execution: The
SKILL.mdinstructions guide the agent to execute a bundled Python helper script. While this involves command-line execution, the scope is limited to the skill's own internal script and intended functionality. - External Dependencies: The Python helper script relies on standard libraries such as
beautifulsoup4,pillow, andpython-pptx. These are well-known, industry-standard packages used for parsing HTML and generating presentation files. - SVG Sanitization: The script implements a robust sanitization process for SVG markup and CSS before rendering charts. This includes blocking potentially risky tags (e.g.,
<script>,<iframe>) and removing event handlers (on*), which is a good security practice for handling potentially untrusted HTML content. - No Remote Operations: The analysis confirmed that the skill does not perform direct network requests or download code from untrusted remote servers; it requires the user to provide a local report file.
Audit Metadata