sn-deep-research

This code implements a PPT workbench server and configured AI-agent integrations; it does not show clear malicious intent or a fixed suspicious exfiltration destination. It forwards user-provided prompts, slide/deck context, and optional images to configured providers, and passes configured environment credentials to agent subprocesses. The main security concerns are unauthenticated API routes if exposed beyond localhost, ACP's automatic permission selection and symlink-insensitive workspace boundary, and incomplete HTML/CSS sanitization; the default bind address is 127[.]0[.]0[.]1. Mermaid assets are fetched from registry[.]npmmirror[.]com, cdn[.]jsdelivr[.]net, or unpkg[.]com with a pinned SHA-256 check; severity is moderate and configuration/deployment dependent.