The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/thumbnail.py executes the system commands soffice (LibreOffice) and pdftoppm (Poppler) via subprocess.run to convert PowerPoint files to PDF and then into image grids for thumbnails. These calls use list-based arguments without a shell, which prevents shell injection vulnerabilities.
[COMMAND_EXECUTION]: The script ooxml/scripts/pack.py utilizes the soffice utility to validate the integrity of generated Office documents through a headless conversion process.
[REMOTE_CODE_EXECUTION]: The converter logic in scripts/html2pptx.js employs Playwright (headless Chromium) to render local HTML files. This execution is confined to a browser context and is used solely to calculate CSS positions and layout dimensions for PowerPoint generation.
[SAFE_PRACTICE]: The skill demonstrates security awareness by using the defusedxml library in ooxml/scripts/pack.py and ooxml/scripts/unpack.py to parse XML content, which effectively mitigates XML External Entity (XXE) vulnerabilities when handling Office document structures.

pptx-skill