seaslides-typst-slides-skill
Pass
Audited by Gen Agent Trust Hub on Aug 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The toolset utilizes
subprocess.run()in several utility scripts (such asbatch_validate.py,project_manager.py, andtypst_compiler.py) to invoke the Typst compiler and Pandoc for document processing. These operations are constrained to verified project paths and use argument lists to prevent shell injection. - [EXTERNAL_DOWNLOADS]: The skill includes functionality to fetch content from web URLs and interact with established AI provider APIs (OpenAI, Google Gemini, Alibaba Cloud, etc.) for image and audio generation. These network operations are intrinsic to the skill's purpose and are implemented using standard Python libraries with proper credential management.
- [SAFE]: Security-sensitive operations, such as loading API keys from environment variables or
.envfiles, are restricted by prefix filtering. File system operations are protected against path traversal through sanitization and relative path resolution within the project workspace.
Audit Metadata