The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run in src/pptskill/export_png.py to execute PowerShell commands. This is used to interface with the PowerPoint COM object for slide-to-PNG export on Windows systems.
[DYNAMIC_EXECUTION]: The skill employs dynamic modules and function calls. In src/pptskill/export_png.py, __import__("os") is used to access system environment variables. In src/pptskill/layouts/__init__.py, inspect.signature is used to dynamically dispatch rendering functions based on JSON slide types.
[PRIVILEGE_ESCALATION]: The PowerShell command execution in src/pptskill/export_png.py includes the -ExecutionPolicy Bypass flag, which allows the execution of scripts that might otherwise be blocked by the local system's security policy.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided JSON outline files. While this creates an attack surface for indirect prompt injection (e.g., malicious content in titles or bullets), the skill implements mitigation measures including schema validation and content-check heuristics (via pptx-penfick validate and pptx-penfick content-check).

pptx-penfick