The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill automatically downloads and installs Python and Node.js packages if they are missing from the host environment. This behavior bypasses traditional installation workflows and relies on unversioned '@latest' tags, posing a risk of supply-chain exploitation.
File: scripts/export_pptx.py (lines 142, 192)
Evidence: subprocess.call([sys.executable, "-m", "pip", "install", "--user", "pyyaml"]) and subprocess.call([npm, "install", "-g", "agent-browser@latest"]).
File: scripts/export_images.py (lines 48, 126)
Evidence: subprocess.call([sys.executable, "-m", "pip", "install", "--user", "pillow"]) and subprocess.call([sys.executable, "-m", "pip", "install", "--user", "websocket-client"]).
[COMMAND_EXECUTION]: The skill makes extensive use of the subprocess module to manage workflows between Python, Node.js, and browser processes.
File: scripts/export_pptx.py and scripts/export_images.py
Evidence: Coordination of exports through various calls to subprocess.run and subprocess.call to drive external scripts and browser tools.
[PROMPT_INJECTION]: The skill's instructions use authoritative and imperative language designed to override the agent's default behaviors and enforce strict constraints on design and output generation.
File: SKILL.md and reference files under reference/.
Evidence: Instructions such as "stop immediately," "strictly forbid," and "do not continue" are used to dictate the agent's task-handling logic.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted user-supplied content and URLs while possessing the capability to execute system commands.
Ingestion points: SKILL.md (Step 1: "Read all files uploaded by the user, the provided URLs...").
Boundary markers: Absent. There are no instructions to the agent to treat data from user files as untrusted or to ignore embedded commands.
Capability inventory: scripts/export_pptx.py and scripts/export_images.py (Subprocess execution, file system access, network access).
Sanitization: Absent. The skill lacks logic to sanitize user-provided text before it is consumed by the presentation generation scripts.

open-kimi-ppt