Security audit
Security checks across malware telemetry and agentic risk
This PPT-generation skill is mostly coherent, but it should be reviewed because it can auto-run broad workflows, install packages, execute shell commands, and send slide-related data to external services.
Install only in an isolated project or container, review and approve all npm/pip/npx commands before running, avoid confidential topics when Unsplash or visual model audit is enabled, and do not pass untrusted strings to subagent_logger.py. This is not classified as malicious because the risky behavior is largely tied to the stated PPT workflow and there is no artifact-backed evidence of deception, destructive action, or intentional exfiltration.
# 安装 puppeteer-core
print("Installing puppeteer-core...")
import subprocess
subprocess.run(
["npm", "install", "puppeteer-core"],
capture_output=True, text=True, timeout=60
))
if r.returncode != 0:
print("Installing dom-to-svg...")
subprocess.run(["npm", "install", "dom-to-svg"],
capture_output=True, text=True, timeout=60, cwd=str(work_dir))
r = subprocess.run(
["node", "-e", "require('dom-to-svg')"],print("Building dom-to-svg browser bundle...")
entry_path = work_dir / ".bundle_entry.js"
entry_path.write_text(BUNDLE_ENTRY)
r = subprocess.run(
["npx", "-y", "esbuild", str(entry_path),
"--bundle", "--format=iife",
f"--outfile={bundle_path}", "--platform=browser"],try:
print(f"Converting {len(html_files)} HTML files (dom-to-svg, text editable)...")
r = subprocess.run(
["node", str(script_path), json.dumps(config)],
cwd=str(work_dir), timeout=300, env=env
)if r.returncode != 0:
# 安装 puppeteer-core
print(" -> Installing puppeteer-core...")
subprocess.run(
["npm", "install", "puppeteer-core"],
capture_output=True, text=True, timeout=60, cwd=str(work_dir)
)write_log(log_path, log_entry(session_id, stage, "command_start", {"command": command}))
start_time = time.time()
process = subprocess.Popen(
command,
shell=True,
stdout=subprocess.PIPE,**Unsplash API 调用方式**：
```javascript
// 按关键词搜索图片
GET https://api.unsplash.com/search/photos?query={关键词}&per_page=1
// 请求头
Authorization: Client-ID {UNSPLASH_ACCESS_KEY}67/67 vendors flagged this skill as clean.