pptx
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runin several utility scripts to perform legitimate presentation-related operations. scripts/thumbnail.pyandooxml/scripts/pack.pyinvokesoffice(LibreOffice) to convert presentations to PDF or HTML for validation and thumbnail generation.scripts/thumbnail.pyinvokespdftoppm(Poppler) to convert PDF pages into slide images.ooxml/scripts/validation/redlining.pyusesgit diffto calculate text-level differences between original and modified documents.- [DATA_EXPOSURE]: The skill handles XML parsing securely.
- Both
ooxml/scripts/unpack.pyandooxml/scripts/pack.pyutilize thedefusedxmllibrary, which is specifically designed to mitigate XML External Entity (XXE) and other XML-based vulnerabilities. - [DYNAMIC_EXECUTION]: The
html2pptx.jsscript uses Playwright (via theplaywrightpackage) to render HTML slides in a headless browser. - The script is restricted to loading local files using the
file://protocol, which is a controlled environment for converting agent-generated HTML into PowerPoint elements.
Audit Metadata