kingdee-ppt

Pass

Audited by Gen Agent Trust Hub on Jun 22, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill implements a self-update mechanism in bin/kingdee-ppt-update-check and bin/kingdee-ppt-upgrade that communicates with the public npm registry (registry.npmjs.org) to fetch version information and download updates.
  • [EXTERNAL_DOWNLOADS]: The skill fetches AI brand logos as SVG or PNG assets from registry.npmmirror.com and unpkg.com during the slide generation process as described in pptx-builder.md and references/ai-brand-logos.md.
  • [EXTERNAL_DOWNLOADS]: The scripts/install.sh script attempts to clone the skill repository from GitHub and installs Node.js dependencies using npm install.
  • [COMMAND_EXECUTION]: The skill executes shell commands for various operational tasks, including checking for updates, performing self-upgrades, and managing file system symlinks via scripts/postinstall.sh.
  • [COMMAND_EXECUTION]: At runtime, the skill invokes external binaries such as soffice (LibreOffice) for PDF conversion, pdftoppm for image generation, and node to run the PPTX construction scripts.
  • [COMMAND_EXECUTION]: The scripts/html2pptx.js utility uses the Playwright library to launch a Chromium browser instance to render and process local HTML content for conversion into PowerPoint slides.
  • [DATA_EXFILTRATION]: While the skill performs network requests, they are limited to checking for software updates on registry.npmjs.org and fetching visual assets from common CDNs (npmmirror.com, unpkg.com). No sensitive local data access or unauthorized exfiltration patterns were detected.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 22, 2026, 01:57 PM
Security Audit — agent-trust-hub — kingdee-ppt