The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run to invoke system tools required for document processing, such as LibreOffice (soffice) for file conversion, LaTeX engines (xelatex, pdflatex) for formula rendering, and PowerShell on Windows for PowerPoint automation. These operations are core to the skill's functionality and include safety measures like parameter quoting and path validation.
[EXTERNAL_DOWNLOADS]: The skill communicates with well-known cloud services including Baidu AI Studio (for PaddleOCR text recognition) and OpenAI (for image generation/editing). These network operations are directed to official endpoints and are explicitly documented to inform the user about data transmission.
[SAFE]: The skill demonstrates a high level of security awareness through several built-in protections:
Path Confinement: A centralized resolve_inside utility is used to ensure all file reads and writes remain within the designated job or page directories, preventing path traversal attacks.
SSRF Protection: The image generation module includes a specialized URL validator that enforces HTTPS, prevents access to localhost or local hostnames, and checks that resolved IP addresses are global, mitigating server-side request forgery risks.
Secret Management: API keys and tokens are stored in an external config.yaml file (excluded from version control) or environment variables. The runtime_env.py script includes a mask_secret function to ensure these credentials are not exposed in logs or console output.
XML Security: The skill utilizes the defusedxml library for parsing potentially untrusted XML content, protecting against XML External Entity (XXE) and billion laughs attacks.

nature-image2ppt