pptx
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses the defusedxml library in ooxml/scripts/unpack.py and ooxml/scripts/pack.py to handle Office Open XML files. This is a secure practice that mitigates XML External Entity (XXE) and billion laughs attacks.\n- [COMMAND_EXECUTION]: The skill invokes external system utilities including soffice (LibreOffice), pdftoppm (Poppler), and git diff via subprocess.run in scripts/thumbnail.py, ooxml/scripts/pack.py, and ooxml/scripts/validation/redlining.py. These calls are implemented safely using argument lists instead of shell strings, which prevents command injection vulnerabilities.\n- [DYNAMIC_EXECUTION]: The html2pptx workflow utilizes Playwright (in scripts/html2pptx.js) to render local HTML content into slide layouts. This dynamic rendering is used legitimately for visual slide generation and does not involve executing untrusted remote code.
Audit Metadata