The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes several Python and Node.js scripts that execute external system binaries to process presentation files and images.
Evidence:
container_tools/render_slides.py executes soffice (LibreOffice) to convert PPTX files to PDF and ODP.
container_tools/ensure_raster_image.py executes inkscape, magick/convert, gs (Ghostscript), heif-convert, and JxrDecApp to process various image formats.
container_tools/detect_font.py executes fc-list to query system fonts.
pptxgenjs_helpers/text.js executes fc-match via spawnSync to resolve font paths.
Mitigation: These scripts use list-based arguments for subprocess calls rather than shell strings, which significantly reduces the risk of command injection. The skill also explicitly requires defusedxml to mitigate XML-based attacks when parsing OOXML files.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process user-provided presentation files, which creates a potential surface for indirect prompt injection.
Ingestion points: Presentation files are loaded and parsed in container_tools/render_slides.py and via the PresentationFile.import_pptx method described in artifact_tool/inspect.spec.md.
Boundary markers: No specific boundary markers or instructions to ignore embedded commands were identified for the text content within processed slides.
Capability inventory: The skill can execute system commands (via the renderers), read/write to the local filesystem, and control a browser via agent-browser (as instructed in SKILL.md).
Sanitization: While defusedxml provides protection against XML External Entity (XXE) attacks, the natural language content within the slides is not sanitized against adversarial instructions.

slide-skill