soia-pkm-transform-article-ppt
Pass
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a local Python script,
scripts/media_bundle.py, to manage the creation and validation of presentation media bundles. Technical review of the script confirms it relies solely on standard Python libraries to perform file parsing and validation tasks. - [EXTERNAL_DOWNLOADS]: Documentation references the installation of
notebooklm-pyand the addition of vendor-specific skills throughnpx skills add. These resources are either associated with the vendorsoia-teamor well-known services like NotebookLM, representing standard integration procedures. - [DATA_EXFILTRATION]: The skill contains a robust privacy mechanism in
scripts/media_bundle.py. It uses a specific regular expression (BANNED_TEXT) to scan generated PPTX files and block the inclusion of sensitive local information, such as system user paths (e.g.,/Users/) or internal runtime metadata. - [PROMPT_INJECTION]: Because the skill processes external content like URLs and Markdown articles, it has a surface for indirect prompt injection. The skill mitigates this through 'Quality Gates' and explicit instructions to verify that all output is strictly grounded in the provided source material.
Audit Metadata