pptx
Pass
Audited by Gen Agent Trust Hub on Mar 13, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runto call system binariessoffice(for document validation and conversion),pdftoppm(for image extraction), andgit(for word-level diffing). These operations are restricted to document processing tasks aligned with the skill's primary purpose. - [SAFE]: Robust XML security is implemented in
ooxml/scripts/unpack.pyandooxml/scripts/pack.pyby utilizingdefusedxmlto prevent XML External Entity (XXE) vulnerabilities. - [SAFE]: While the skill ingests user-provided PPTX and HTML data (ingestion points in
scripts/inventory.pyandscripts/html2pptx.js), the processing is limited to structural extraction and layout rendering. No boundary-crossing logic or instruction-overriding markers were detected.
Audit Metadata