paper-beamer-deck

Pass

Audited by Gen Agent Trust Hub on Jun 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The scripts render_pdf_pages.py and extract_figures.py execute local system utilities such as xelatex, pdftoppm, and pdftocairo via Python's subprocess module. These operations are essential for building and rendering slide decks. The skill includes validation logic to ensure that arguments like page numbers are sanitized as integers before command execution.
  • [EXTERNAL_DOWNLOADS]: The skill documentation references established open-source projects including pymupdf and docling for PDF analysis. The installation of system tools like poppler-utils is also suggested. The docling library may download model artifacts upon its first run, which is expected behavior for its layout-analysis functionality.
  • [PROMPT_INJECTION]: Because the skill processes external academic PDFs to generate slide content, it is subject to indirect prompt injection. This risk is mitigated by a mandatory visual QA workflow that requires a human or the agent to inspect rendered previews and a 'fail-on-warning' LaTeX log check that detects layout anomalies or code errors resulting from malformed input.
  • [COMMAND_EXECUTION]: The skill's test suite utilizes importlib to dynamically load local scripts for regression testing. This activity is restricted to the skill's internal directory and does not involve executing code from remote sources or processing untrusted strings as executable code.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 16, 2026, 05:14 AM
Security Audit — agent-trust-hub — paper-beamer-deck