The Agent Skills Directory

External Downloads: The skill references a shell script to install the uv package manager from a well-known technology provider (Astral). This is a routine setup procedure for Python development environments and is considered a common practice in this ecosystem.
Evidence: curl -LsSf https://astral.sh/uv/install.sh | sh in SKILL.md and scripts/invoke-pptx-pipeline.sh.
Command Execution: The skill invokes system utilities like LibreOffice (soffice) and pdftoppm to handle document conversions. These subprocesses are managed using structured argument lists without shell interpolation, which is a defensive programming pattern that prevents command injection.
Evidence: subprocess.run([soffice, '--headless', ...]) in scripts/export_slides.py and scripts/export_svg.py.
Dynamic Execution: The presentation builder allows for the inclusion of per-slide Python scripts (content-extra.py) to perform complex drawings.
Evidence: spec.loader.exec_module(mod) in scripts/build_deck.py.
Context: This capability is gated behind a manual --allow-scripts flag and is subject to a static analysis (AST) lint that blocks dangerous modules like os and subprocess. However, the skill's own security documentation acknowledges that the lint is not a sound sandbox and that an authorized script runs with the permissions of the host process. Execution should only be granted to trusted, reviewed scripts.

powerpoint