nature-image2ppt
Pass
Audited by Gen Agent Trust Hub on Aug 23, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill connects to Baidu AI Studio (
paddleocr.aistudio-app.com) for OCR processing and OpenAI/ChatGPT (api.openai.com,chatgpt.com) for image generation. These are well-known service providers used for the skill's primary functionality and are treated as safe sources. - [COMMAND_EXECUTION]: The skill executes local system utilities (LibreOffice, ImageMagick) and LaTeX engines to perform document conversion and formula rendering. All command execution is handled through parameter lists with path validation using a
resolve_insidehelper to prevent directory traversal. On Windows, PowerShell automation for PowerPoint includes path escaping specifically designed for PowerShell string literals. - [DATA_EXPOSURE]: API keys and tokens for Baidu and OpenAI are managed through local configuration files (git-ignored) or environment variables. The skill includes logic to mask these secrets in diagnostic output and provides clear instructions on secure credential storage.
- [INDIRECT_PROMPT_INJECTION]: While the skill processes untrusted text from images via OCR, it utilizes structured JSON manifests and deterministic build logic to convert this data into PowerPoint XML (OOXML), minimizing the risk of instruction leakage. The agent is further constrained by specific workflow instructions and a 'Page Reconstructor' persona defined in the prompts.
Audit Metadata