competitive-analysis
Pass
Audited by Gen Agent Trust Hub on Apr 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill ensures the
python-pptxlibrary is available by installing it from the official Python Package Index (PyPI). PyPI is a well-known and standard service for Python dependencies. - [COMMAND_EXECUTION]: Shell commands are used to verify the environment and install necessary libraries (
python3 -c "import pptx"andpython3 -m pip install). These operations are restricted to environment preparation. - [PROMPT_INJECTION]: The skill processes external, user-provided data files (Excel/CSV), creating a surface for potential indirect prompt injection.
- Ingestion points: Untrusted data enters the agent context via user-uploaded Excel or CSV files (SKILL.md, Phase 1).
- Boundary markers: Absent. No explicit delimiters or instructions to ignore embedded commands are specified for the data ingestion process.
- Capability inventory: The skill uses
python-pptxfor generating slide content. No network operations or arbitrary shell execution capabilities are utilized during data processing. - Sanitization: The skill lacks automated sanitization for the ingested data, relying instead on manual user confirmation of data mappings.
Audit Metadata