The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill recommends installing the 'python-pptx' library from standard package registries and references documentation and source material from a trusted organization's GitHub repository (anthropics/financial-services). These are standard development practices.
[DATA_EXPOSURE_&_EXFILTRATION]: The skill explicitly states a 'No external sends' policy, indicating it is designed for local file generation only. It accesses local files like './templates/firm-template.pptx' and './out/model.xlsx', which is consistent with its stated purpose of building decks from local data sources.
[COMMAND_EXECUTION]: The skill provides Python code snippets for presentation generation. These use standard library calls (pathlib) and the python-pptx API. There is no evidence of arbitrary shell command execution or unsafe subprocess spawning.
[INDIRECT_PROMPT_INJECTION]: While the skill processes data from Excel workbooks (e.g., via openpyxl), it treats these as data sources for slides. The output is a static .pptx file, which does not feed back into the agent's instruction cycle, significantly limiting the surface for indirect injection attacks.

pptx-author