pptx
Create, edit, review, and finalize editable Microsoft PowerPoint .pptx presentations. Use for new decks, source- or template-based presentations, targeted slide edits, charts, tables, images, speaker notes, visual QA, and legacy .ppt conversion. Do not use for HTML/browser presentations, Google Slides, or live Microsoft PowerPoint control.
72
89%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
2 low severity findings. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
Outsider-authored free text is ingested at runtime only via user-provided PPTX/PPT files: `scripts/lib/ooxml.mjs` parses XML inside the supplied presentation package (`loadPptxPackage` → `readPptxFacts` → `presentationSlides` → `normalizedText` reading `<t>`/`<p>` text from slides and notes), with no web/search/queue feed or “select specific outsider content first” step.
W012: Unverifiable external dependency detected (runtime URL that controls agent).
What this means
The skill fetches instructions or code from an external URL at runtime, and the fetched content directly controls the agent’s prompts or executes code. This dynamic dependency allows the external source to modify the agent’s behavior without any changes to the skill itself.
Why it was flagged
The skill runs npm ci at runtime (scripts/pptx.sh) to install the pinned JS runtime which fetches and installs packages from the npm registry (e.g. https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.9.10.tgz and https://registry.npmjs.org/jszip/-/jszip-3.10.1.tgz), and those fetched packages (xmldom, jszip) are required and executed by the skill (scripts/lib/runtime.mjs), so remote code is fetched and run as a required runtime dependency.
- Repository
- OpenBMB/PilotDeck
- Commit
5b802a8
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.