pitch-deck-visuals
Pass
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the belt CLI tool to execute remote applications (e.g., infsh/html-to-image, infsh/python-executor, falai/flux-dev-lora). This is the core functionality of the skill for generating slide visuals through the vendor's platform.
- [DYNAMIC_EXECUTION]: The skill generates Python scripts using the matplotlib library and HTML/CSS snippets. These are executed via remote applications to produce images and charts based on user-provided data.
- [EXTERNAL_DOWNLOADS]: References an installation guide hosted on raw.githubusercontent.com in the vendor's repository (inference-sh/skills). This is used for initial setup of the belt CLI environment.
- [PROMPT_INJECTION]: The skill processes user-supplied content to populate slides. While this presents a surface for indirect prompt injection if malicious data is interpolated into the HTML or Python templates, this is a common characteristic of data visualization tools. Mitigation involves the underlying executors implementing proper sanitization of input strings.
Audit Metadata