presentation-builder
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes external command-line utilities using
subprocess.runto perform necessary document transformations and validations: soffice(LibreOffice) is used for converting PowerPoint files to PDF and for validating document integrity during the packing process by verifying it can be exported to HTML.pdftoppm(Poppler) is used to convert PDF pages into JPEG thumbnails to allow the agent to visually inspect slide layouts.gitis utilized in the redlining validator to generate character-level diffs for comparing document versions during tracked change validation.- [DYNAMIC_EXECUTION]: The
html2pptx.jsscript utilizes Playwright's Chromium browser automation to render HTML content for slide generation. It usespage.evaluateto execute layout extraction logic within the browser context, which is the core mechanism for calculating accurate positions for the PowerPoint elements. This is a standard and necessary implementation for the skill's primary purpose. - [SAFE]: The skill demonstrates security consciousness by using the
defusedxmllibrary for all XML parsing operations, effectively mitigating XML External Entity (XXE) and other XML-based vulnerabilities. All operations are performed on local files within the agent's environment, and the behavior is strictly consistent with the documented purpose of document processing.
Audit Metadata