Security audit
Security checks across malware telemetry and agentic risk
This slide generator largely matches its purpose, but it includes under-disclosed save/write behavior and an unrelated privileged desktop preload file that deserve review before installation.
Review before installing. The core slide-generation workflow appears legitimate, but generated decks should be treated as active HTML, not purely static files: they can load Google Fonts and Ctrl/Cmd+S may send the full edited deck back to the page URL before downloading a copy. Avoid hosting generated decks on origins that accept unauthenticated PUT, and remove or ignore the unrelated preload.cjs unless you know your desktop host will not load it.
def test_export_script_importable(export_script):
"""export-pptx.py must be importable (syntax check)."""
result = subprocess.run(
[sys.executable, "-c", f"import ast; ast.parse(open('{export_script}').read())"],
capture_output=True, text=True
)native_script = export_script.parent / "export-native-pptx.py"
assert native_script.exists(), f"export-native-pptx.py not found at {native_script}"
result = subprocess.run(
[sys.executable, "-c",
f"import importlib.util; "
f"spec = importlib.util.spec_from_file_location('m', '{native_script}'); "65/65 vendors flagged this skill as clean.
Detected: suspicious.dynamic_code_execution