Security audit
Security checks for vulnerabilities and agentic risk
This skill coherently creates Reveal.js HTML slide decks, with the main caveat that generated slides load third-party CDN resources in the browser.
Install this if you are comfortable generating HTML slide decks that load Reveal.js, plugins, MathJax, stylesheets, and possibly media from public CDNs when opened. For confidential presentations or offline use, replace CDN links with local pinned assets before sharing or presenting.
The invocation guidance says to use this skill when the user asks to create 'a presentation' or 'slides', which are broad everyday requests that could match many slide-generation contexts beyond this specific Reveal.js HTML skill. The description does not provide narrower trigger constraints or exclusion examples to distinguish when this skill should or should not activate.
The template executes several remote JavaScript files directly from CDNs, including Reveal.js plugins and MathJax. This is more dangerous than remote CSS because compromise of those upstream resources or of the delivery path can lead to arbitrary script execution in the browser when the generated HTML is opened.
The skill instructs the agent to save a final HTML file to the user's desired location or current folder, which is a file write operation. While it later says to inform the user after creation, the document does not explicitly warn beforehand that the skill will write a file to disk or emphasize the destination implications.
The root HTML element sets lang="en", which establishes English as the default language with no indication that other locales are supported or that the choice is intentional for a region-specific use case. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy concern.
The template loads multiple third-party stylesheets from public CDNs, which causes generated presentations to contact external services when opened. While not code-execution by itself, it creates a supply-chain and privacy risk because CDN compromise, tracking, or blocked network access can alter rendering or leak user IP and metadata without disclosure.
No suspicious patterns detected.
