Is Gpt Image2 Ppt Skills safe?
- Python shell/command execution
- Python filesystem read
- Python filesystem write/delete
repo is an AI agent_skill analyzed by SkillTotal's deterministic static scanner. The scan found no malicious indicators, though 4 risky constructs are reported for review. It can: filesystem read, filesystem write, network egress and shell execution — capabilities are what the code can do, not a verdict on intent. Risk score 0/100 (low).
repo
Automated static-analysis result. It can contain false positives and false negatives, and is not a claim about the intent of Gpt Image2 Ppt Skills's authors. Report a false positive.
Behavioral traits
How this component maps to the CSA agentic threat model. Descriptive — it never affects the risk score.
Findings (4)
The component can run operating-system commands or spawn processes.
result = subprocess.run(
argv,
capture_output=True,
text=True,
timeout=self.timeout,
check=False,
)result = subprocess.run(
[path, *args],
check=False,
capture_output=True,
text=True,
timeout=timeout,
)result = subprocess.run(
[sys.executable, "-m", "pip", "install", "pywin32"],
check=False, capture_output=True, text=True,
)result = subprocess.run(
["osascript", "-e", script],
check=True, capture_output=True, text=True, timeout=120,
)subprocess.run(
[cli, "--headless", "--convert-to", "pdf",
"--outdir", str(out_pdf.parent), str(pptx_path)],
check=True, capture_output=True, text=True,
)Why it matters: Powerful and often legitimate — confirm the commands aren't built from untrusted input.
Fix: Confirm the command and its arguments are fully controlled and not derived from untrusted input; avoid shell=True.
The component reads files from disk.
return json.loads(path.read_text(encoding="utf-8")), path.parent
with open(image_path, "rb") as image_file, open(mask_path, "rb") as mask_file:
data = json.loads(scene_path.read_text(encoding="utf-8"))
with open(meta_path, "r", encoding="utf-8") as f:
with open(meta_path, "r", encoding="utf-8") as f:
with open(style_path, "r", encoding="utf-8") as f:
with open(sidecar, "r", encoding="utf-8") as f:
return json.loads(path.read_text(encoding="utf-8"))
with open(prompts_path, "r", encoding="utf-8") as f:
with open(prompt_path, "r", encoding="utf-8") as f:
with open(args.template_profile, "r", encoding="utf-8") as f:
with open(args.plan, "r", encoding="utf-8") as f:
with open(path, "rb") as f:
with open(ref_path, "rb") as f:
plan = md_to_plan(src.read_text(encoding="utf-8"))
with open(path, "rb") as f:
manifest = json.loads(manifest_path.read_text(encoding="utf-8"))
with open(path, "rb") as f:
with open(pptx_path, "rb") as f:
with open(img, "rb") as f:
with open(cache_path, "r", encoding="utf-8") as f:
Why it matters: Usually legitimate, but worth confirming it can't be steered into reading sensitive files.
Fix: Confirm which files are read and that paths cannot be influenced by untrusted input to reach sensitive locations.
The component writes or deletes files on disk.
report_path.write_text(json.dumps(report, ensure_ascii=False, indent=2), encoding="utf-8")
path.write_bytes(self._decode_first_image(response))
path.write_bytes(self._decode_first_image(response))
report_path.write_text(json.dumps(report, ensure_ascii=False, indent=2), encoding="utf-8")
os.unlink(tmp_path)
path.write_text(json.dumps(data, ensure_ascii=False, indent=2), encoding="utf-8")
with open(prompts_path, "w", encoding="utf-8") as f:
_shutil.copy2(png, dest)
_shutil.copy2(png, current)
_shutil.copy2(current_img, versioned_img)
with open(prompt_abs, "w", encoding="utf-8") as f:
_shutil.copy2(current_img, versioned_new)
_shutil.copy2(current_img, versioned_img)
with open(prompt_abs, "w", encoding="utf-8") as f:
_shutil.copy2(current_img, versioned_new)
with open(prompt_abs, "w", encoding="utf-8") as pf:
_shutil.copy2(image_path, versioned_initial)
with open(output_path, "wb") as f:
with open(output_path, "wb") as f:
os.remove(output_path)
os.remove(output_path)
dst.write_text(json.dumps(plan, ensure_ascii=False, indent=2), encoding="utf-8")
_render_manifest_path(out_dir).write_text(
json.dumps(manifest, ensure_ascii=False, indent=2),
encoding="utf-8",
)shutil.rmtree(dest_prefix, ignore_errors=True)
with open(cache_path, "w", encoding="utf-8") as f:
Why it matters: Usually legitimate, but worth confirming the paths can't be controlled by untrusted input.
Fix: Confirm which files are written/deleted and that paths cannot be influenced by untrusted input.
The component makes outbound network requests.
import requests
from urllib.parse import urlparse
parsed = urlparse(url)
resp = requests.get(url, stream=True, timeout=REQUEST_TIMEOUT_SECS)
resp = requests.post(
url, headers=headers, json=payload,
stream=True, timeout=REQUEST_TIMEOUT_SECS,
)resp = requests.post(url, headers=headers, json=payload, timeout=REQUEST_TIMEOUT_SECS)
import requests
resp = requests.post(
self.endpoint, headers=headers, json=payload, timeout=VISION_TIMEOUT_SECS
)Why it matters: Usually legitimate, but confirm the destinations are expected and no sensitive data leaves.
Fix: Confirm the destination hosts are expected and that no sensitive data is sent off-host.
Check your own component
Run the same evidence-backed scan on any MCP server, agent skill, or package.
Scan your own componentHow we determine this: deterministic static analysis (regex + AST), evidence-anchored, no code execution. Methodology →