The Agent Skills Directory

[SAFE]: The skill performs local file conversion without any network activity or unauthorized data access.
[COMMAND_EXECUTION]: The conversion script uses the python-pptx and pymupdf libraries for parsing files. No dangerous shell commands or arbitrary code execution patterns were found.
[PROMPT_INJECTION]: Instructions for the agent are clear and focused on the conversion task, with no attempts to bypass safety protocols or extract system prompts.
[SAFE]: The skill processes untrusted input files (PPTX/PDF), which creates a potential surface for indirect prompt injection. However, it implements security best practices to mitigate this risk:
Ingestion points: Content is extracted from user-provided files in scripts/convert_deck.py via extract_from_pptx and extract_from_pdf functions.
Boundary markers: Extracted content is encapsulated within specific HTML tags such as headings and paragraphs in the generated presentation.
Capability inventory: The skill possesses file read and write capabilities required for its conversion task but no network access or code execution capabilities.
Sanitization: An escape_html function is used to sanitize all extracted text before it is interpolated into the HTML template, preventing script injection and Cross-Site Scripting (XSS).

deck-web-converter