seaslides-typst-slides-skill

Pass

Audited by Gen Agent Trust Hub on Aug 5, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The toolset utilizes subprocess.run() in several utility scripts (such as batch_validate.py, project_manager.py, and typst_compiler.py) to invoke the Typst compiler and Pandoc for document processing. These operations are constrained to verified project paths and use argument lists to prevent shell injection.
  • [EXTERNAL_DOWNLOADS]: The skill includes functionality to fetch content from web URLs and interact with established AI provider APIs (OpenAI, Google Gemini, Alibaba Cloud, etc.) for image and audio generation. These network operations are intrinsic to the skill's purpose and are implemented using standard Python libraries with proper credential management.
  • [SAFE]: Security-sensitive operations, such as loading API keys from environment variables or .env files, are restricted by prefix filtering. File system operations are protected against path traversal through sanitization and relative path resolution within the project workspace.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 5, 2026, 09:58 AM