slide-renderer

Pass

Audited by Gen Agent Trust Hub on Mar 10, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill relies on official and well-known libraries, specifically 'google-genai' and 'Pillow'. These are standard packages for interacting with Google's AI services and performing image processing, respectively.- [COMMAND_EXECUTION]: The skill instructions in SKILL.md guide the agent to execute a local Python script 'generate_slide_images.py'. This execution is limited to the skill's own provided script and uses arguments provided by the user for input and output directories.- [PROMPT_INJECTION]: The script 'scripts/generate_slide_images.py' processes user-provided markdown files and passes their content directly to the Gemini API. While this presents a surface for indirect prompt injection where an input file might attempt to override image generation instructions, it is an essential part of the skill's functionality and is protected by the model's internal safety guardrails. Evidence: 1. Ingestion point: 'extract_prompt_content' function reads file content. 2. Boundary markers: None. 3. Capabilities: Network access to Google APIs and local file-write for image output. 4. Sanitization: No content filtering is applied prior to API calls.- [SAFE]: Credentials such as 'GEMINI_API_KEY' are handled via environment variables, which is the recommended secure approach for managing API secrets.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 10, 2026, 11:41 AM