frontend-slides
Pass
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted external data, including PowerPoint files and existing HTML presentations. This creates a surface for indirect prompt injection, where malicious instructions embedded in the source data could potentially influence the agent. The risk is minimized by the skill's structured approach to layout and formatting.
- [COMMAND_EXECUTION]: The skill utilizes a local Python script (
scripts/extract-pptx.py) to extract content from presentations. This script proactively implements asafe_user_pathfunction to validate file paths and prevent path traversal attacks, which is a positive security measure. - [EXTERNAL_DOWNLOADS]: The skill references standard, well-known Python packages (
python-pptx,Pillow) and integrates fonts from reputable services like Google Fonts and Fontshare. These are standard dependencies for the skill's intended functionality.
Audit Metadata