make-revealjs-presentation
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's HTML template fetches RevealJS, Highlight.js, and a menu plugin from the JSDelivr CDN. Additionally, the documentation suggests using the axe-core library from the Cloudflare CDN for accessibility audits. These are recognized, well-known services for hosting web assets.
- [DYNAMIC_EXECUTION]: The instructions include a Playwright code snippet for the agent to perform accessibility audits. This involves injecting the axe-core script into a browser page and evaluating results. This is a standard procedure for automated testing and auditing.
- [INDIRECT_PROMPT_INJECTION]: The skill generates presentations by interpolating user-provided content (such as talk titles and slide text) into an HTML template. This file is then opened in a browser for validation. This pattern represents a surface for indirect injection if the processed data contains malicious scripts; however, this functionality is inherent to the skill's primary purpose of presentation generation and involves data the agent is explicitly instructed to process.
Audit Metadata