paper-beamer-deck
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The scripts
render_pdf_pages.pyandextract_figures.pyexecute local system utilities such asxelatex,pdftoppm, andpdftocairovia Python'ssubprocessmodule. These operations are essential for building and rendering slide decks. The skill includes validation logic to ensure that arguments like page numbers are sanitized as integers before command execution. - [EXTERNAL_DOWNLOADS]: The skill documentation references established open-source projects including
pymupdfanddoclingfor PDF analysis. The installation of system tools likepoppler-utilsis also suggested. Thedoclinglibrary may download model artifacts upon its first run, which is expected behavior for its layout-analysis functionality. - [PROMPT_INJECTION]: Because the skill processes external academic PDFs to generate slide content, it is subject to indirect prompt injection. This risk is mitigated by a mandatory visual QA workflow that requires a human or the agent to inspect rendered previews and a 'fail-on-warning' LaTeX log check that detects layout anomalies or code errors resulting from malformed input.
- [COMMAND_EXECUTION]: The skill's test suite utilizes
importlibto dynamically load local scripts for regression testing. This activity is restricted to the skill's internal directory and does not involve executing code from remote sources or processing untrusted strings as executable code.
Audit Metadata