The Agent Skills Directory

[EXTERNAL_DOWNLOADS] (LOW): The scripts export_pdf.sh, export_pptx.sh, and start_dev_server.sh utilize npx slidev. This command may download the Slidev CLI and its dependencies from the npm registry if not already present. npm is a trusted registry, but this represents a runtime external dependency.
[COMMAND_EXECUTION] (LOW): The skill executes local shell commands to run the Slidev CLI. While the file paths are user-provided, they are enclosed in double quotes within the shell scripts to mitigate standard command injection.
[PROMPT_INJECTION] (LOW): The Python script create_presentation.py performs direct string replacement of user-provided variables into Markdown templates. This creates a surface for indirect prompt injection if the generated files are subsequently processed by an AI agent.
Indirect Prompt Injection Surface (Category 8):
Ingestion points: User-provided key-value pairs in scripts/create_presentation.py.
Boundary markers: Absent; variables are directly interpolated into the .md files.
Capability inventory: Shell execution of Slidev CLI for rendering and exporting.
Sanitization: None.

slidev-ppt