pptx-creator
Pass
Audited by Gen Agent Trust Hub on May 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The compilation process in
scripts/compile.jsinvolves dynamically loading and executing JavaScript files generated by the agent (slide-XX.js) using therequire()function. This constitutes runtime execution of generated code, which is intended for building the final presentation but represents an attack surface for code injection if the generation process were compromised. - [COMMAND_EXECUTION]: The skill instructions and documentation specify the use of shell commands for environment setup and quality assurance. These include global package installations via
npm, Python package installation viapip, and visual inspection using system tools likelibreoffice(soffice) andpoppler(pdftoppm). - [EXTERNAL_DOWNLOADS]: The skill fetches several dependencies from public registries, including
pptxgenjs,react-icons,react,react-dom, andsharpfrom NPM, andmarkitdownfrom PyPI. It also includes functionality to download fonts from Google Fonts and external images via URLs for inclusion in slides.
Audit Metadata