sn-ppt-standard
Pass
Audited by Gen Agent Trust Hub on May 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The dispatcher script
scripts/run_stage.pyinvokes a companion image generation tool viasubprocess.run. These calls use structured argument lists rather than shell evaluation, minimizing the risk of command injection from processed data. - [EXTERNAL_DOWNLOADS]: The conversion utility
scripts/export_pptx/html_to_pptx.mjsautomatically installs its own Node.js dependencies and browser binaries usingnpm installandnpx playwright install. These resources are fetched from the official NPM registry and Playwright distribution (Microsoft), which are well-known and reputable services. - [EXTERNAL_DOWNLOADS]: The image management module
scripts/export_pptx/lib/image_downloader.mjsfetches remote assets identified in the slide HTML to the local filesystem. This is the intended behavior for incorporating remote images into the final PPTX export. - [REMOTE_CODE_EXECUTION]: The skill performs runtime setup by executing installation scripts from standard package registries. This automated environment preparation is a feature of the tool's deployment logic and targets trusted infrastructure.
Audit Metadata