presentation-builder

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill invokes external command-line utilities using subprocess.run to perform necessary document transformations and validations:
  • soffice (LibreOffice) is used for converting PowerPoint files to PDF and for validating document integrity during the packing process by verifying it can be exported to HTML.
  • pdftoppm (Poppler) is used to convert PDF pages into JPEG thumbnails to allow the agent to visually inspect slide layouts.
  • git is utilized in the redlining validator to generate character-level diffs for comparing document versions during tracked change validation.
  • [DYNAMIC_EXECUTION]: The html2pptx.js script utilizes Playwright's Chromium browser automation to render HTML content for slide generation. It uses page.evaluate to execute layout extraction logic within the browser context, which is the core mechanism for calculating accurate positions for the PowerPoint elements. This is a standard and necessary implementation for the skill's primary purpose.
  • [SAFE]: The skill demonstrates security consciousness by using the defusedxml library for all XML parsing operations, effectively mitigating XML External Entity (XXE) and other XML-based vulnerabilities. All operations are performed on local files within the agent's environment, and the behavior is strictly consistent with the documented purpose of document processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 04:59 PM