kingdee-ppt
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill implements a self-update mechanism in
bin/kingdee-ppt-update-checkandbin/kingdee-ppt-upgradethat communicates with the public npm registry (registry.npmjs.org) to fetch version information and download updates. - [EXTERNAL_DOWNLOADS]: The skill fetches AI brand logos as SVG or PNG assets from
registry.npmmirror.comandunpkg.comduring the slide generation process as described inpptx-builder.mdandreferences/ai-brand-logos.md. - [EXTERNAL_DOWNLOADS]: The
scripts/install.shscript attempts to clone the skill repository from GitHub and installs Node.js dependencies usingnpm install. - [COMMAND_EXECUTION]: The skill executes shell commands for various operational tasks, including checking for updates, performing self-upgrades, and managing file system symlinks via
scripts/postinstall.sh. - [COMMAND_EXECUTION]: At runtime, the skill invokes external binaries such as
soffice(LibreOffice) for PDF conversion,pdftoppmfor image generation, andnodeto run the PPTX construction scripts. - [COMMAND_EXECUTION]: The
scripts/html2pptx.jsutility uses the Playwright library to launch a Chromium browser instance to render and process local HTML content for conversion into PowerPoint slides. - [DATA_EXFILTRATION]: While the skill performs network requests, they are limited to checking for software updates on
registry.npmjs.organd fetching visual assets from common CDNs (npmmirror.com,unpkg.com). No sensitive local data access or unauthorized exfiltration patterns were detected.
Audit Metadata