The Agent Skills Directory

[COMMAND_EXECUTION]: The skill requires the execution of shell commands to install several global npm packages and to run the JavaScript scripts it dynamically generates.
[REMOTE_CODE_EXECUTION]: The primary workflow of the skill involves the runtime generation and subsequent execution of JavaScript files to produce PowerPoint decks. This dynamic execution of generated code presents an inherent security risk if the input data used to construct the scripts is untrusted.
[EXTERNAL_DOWNLOADS]: The skill downloads and installs well-known third-party libraries from the npm registry, including pptxgenjs, react, react-dom, react-icons, and sharp.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it transforms user-provided markdown content into executable code without utilizing specific security delimiters or sanitization routines.
Ingestion points: Source markdown files or presentation outlines provided by the user.
Boundary markers: None identified; the skill does not use specific markers to distinguish between system instructions and user-provided data during script generation.
Capability inventory: Capability to install packages, write to the filesystem, and execute shell scripts.
Sanitization: The documentation does not describe any validation or escaping of user input prior to its inclusion in the generated PptxGenJS scripts.

pptx-decks