p-ppt-academic
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of
officecli, a third-party command-line interface tool for manipulating Office documents, hosted on GitHub (github.com/iOfficeAI/OfficeCLI). - This tool is used as the primary mechanism for cloning slides, filling content, and applying formatting to
.pptxfiles. - [COMMAND_EXECUTION]: The skill makes extensive use of local shell commands and scripts to perform its tasks.
- It executes PowerShell scripts (
scripts/export_png.ps1) which leverage Windows COM objects (PowerPoint.Application) for rendering slides to images. - It runs Python scripts (
scripts/qa_check.py,scripts/trim_figure.py) to validate layouts, check for placeholder text, and process images. - It invokes the
officecliexecutable for structured editing of PowerPoint XML structures. - [INDIRECT_PROMPT_INJECTION]: The skill contains a vulnerability surface where it ingests untrusted data from external markdown files for validation purposes.
- Ingestion points: The
scripts/qa_check.pyscript reads a user-specified markdown file via the-sourceargument to perform numerical cross-verification. - Boundary markers: The skill does not implement specific boundary markers or delimiters for the ingested content to prevent the agent from interpreting embedded instructions.
- Capability inventory: The skill has capabilities to modify the local file system (writing to
.pptx), execute shell scripts, and interact with the PowerPoint COM interface. - Sanitization: The Python script uses regular expressions to extract data-like numbers from the source text but does not sanitize the text against potential instruction injection for the agent that processes the script's output.
- [DYNAMIC_EXECUTION]: The skill utilizes dynamic interfaces and batch processing for efficiency.
- It uses
officecli batch --jsonto execute multiple editing commands atomically from a generated JSON structure. - It uses PowerShell COM automation to interact with the Microsoft PowerPoint application at runtime.
Audit Metadata