html-ppt
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches styling and functional assets from well-known and trusted content delivery networks, including webfonts from Google Fonts and the libraries Chart.js and Highlight.js from the JSDelivr CDN. These resources are standard requirements for rendering data visualizations and styling code snippets in the generated presentations.
- [PROMPT_INJECTION]: The skill defines a large ingestion surface for untrusted data by interpolating user-provided text into slide templates. Mandatory Evidence Chain: 1. Ingestion points: Slide content and speaker notes are placed directly into 'templates/single-page/*.html' templates. 2. Boundary markers: Standard HTML tags are used as container delimiters. 3. Capability inventory: The skill utilizes the agent's file writing capabilities to save the generated decks. 4. Sanitization: Relies on the agent's generative safety and the browser environment's script sandboxing.
- [SAFE]: Presentation templates, such as 'testing-safety-alert', include text examples of potentially dangerous shell commands (e.g., 'rm -rf /') and database operations. These illustrative snippets are encoded using HTML entities to prevent false-positive detection by security scanners and are not executable in the context of the skill's runtime environment.
Audit Metadata