deck-creator
Pass
Audited by Gen Agent Trust Hub on Mar 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The playground server and build scripts utilize system utilities to perform project management and asset processing.
- Spawns
gitto manage local repositories and identify remote URLs. - Executes
vercelCLI for linking projects and deploying deck presenters. - Uses
zipto package the presentation assets for export. - Invokes
osascripton macOS to provide a native folder picker for directory selection. - Spawns
magick,sips, and headless Chrome/Chromium to process images and generate PDF exports. - [EXTERNAL_DOWNLOADS]: The skill fetches resources from well-known services and trusted providers.
- Connects to Google Gemini APIs for content, image, and video generation.
- Loads
hls.jsfromjsdelivr.netfor video streaming in the HTML presenter. - Imports typography from Google Fonts.
- [REMOTE_CODE_EXECUTION]: The playground application renders LLM-generated HTML and CSS content using
dangerouslySetInnerHTML. - This creates a surface for Indirect Prompt Injection where malicious input could attempt cross-site scripting (XSS).
- Isolation is attempted via CSS scoping and use of
iframeelements for thumbnails and final output.
Audit Metadata