Agent Economy ReportAgent Economy ReportSAFE version 1.0.0 · audited 2026-09-09
This skill is a set of writing and design instructions plus one example HTML template. It tells the agent how to condense a user's speech script and produce a single dark-themed, vertical (9:16) HTML slide deck with keyboard/touch navigation. There is no script, shell command, credential access, or code execution anywhere in the package; the only 'code' is ordinary HTML/CSS/JavaScript that runs in a browser when the generated deck is opened. The generated deck does pull TailwindCSS and web fonts from third-party CDNs (bytecdntp.com, fonts.loli.net, and hdslb.com in the reference doc), which means opening the presentation contacts those external hosts. The package itself contains no instructions that try to override the agent's rules, no data collection, and no payment or wallet behavior. Overall the behavior matches the stated purpose; the only thing worth reviewing is reliance on external CDN scripts in the output file.
| Declared purpose | Turn a user's speech draft into a Steve Jobs-style minimalist, tech-look vertical (9:16) HTML presentation delivered as a single runnable HTML file. |
| Observed behavior | Provides step-by-step authoring instructions (read draft, condense, write short titles, plan slide types, emit HTML), a reference design spec, a catalogue of slide layouts, and a working HTML/CSS/JS template with slide transitions, progress dots, keyboard arrow and swipe navigation. No filesystem, shell, network, or credential operations are performed by the skill itself; the only outbound requests are the CDN <script> and font <link> tags inside the example template that execute in the end user's browser. |
| Verdict, rules only | SAFE |
| Verdict, AI | SAFE |
| Final verdict | SAFE (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| network | needed | The generated/example HTML loads TailwindCSS from https://lf26-cdn-tos.bytecdntp.com (assets/template.html line 9) and fonts from https://fonts.loli.net (lines 12-13); references/design-spec.md line 39 also suggests s1.hdslb.com. These are third-party CDNs fetched when the deck is opened in a browser, not by the agent. |
| filesystem_read | needed | SKILL.md Step 1 instructs reading the user's own speech draft; no other file access is described. |
| filesystem_write | needed | Output is a single HTML file for the user; no writes outside the produced deck are described. The 'file_writes' facts point at ordinary HTML markup lines, not real write operations. |
| severity | finding |
|---|---|
| low | Generated deck loads third-party JavaScript from a CDN The template embeds a remote script tag. Any code served by that CDN executes in the browser of whoever opens the presentation, and the URL path contains 'expire-1-M', suggesting a cache/expiry-scoped mirror that could stop resolving or change content. This runs in the viewer's browser, not in the agent, but it means the output is not truly offline and depends on an external host's integrity. assets/template.html:9 <script src="https://lf26-cdn-tos.bytecdntp.com/cdn/expire-1-M/tailwindcss/3.0.23/tailwind.min.js"></script> |
| info | External font hosting Fonts are fetched from fonts.loli.net (a third-party Google Fonts mirror), which reveals viewer IP addresses to that host. Disclosed by the publisher as a known risk in skill-card.md. assets/template.html:12 <link href="https://fonts.loli.net/css2?family=Inter:wght@300;400;700;900&display=swap" rel="stylesheet"> |
| info | Additional CDN suggested in reference doc The design reference recommends loading a font stylesheet from s1.hdslb.com (Bilibili's static CDN). Stylesheet-only, no script execution, but another external dependency in the produced file. references/design-spec.md:39 <link href="https://s1.hdslb.com/bfs/static/jinkela/long/font/regular.css" rel="stylesheet"> |
| info | Only the user's own draft is read The instruction limits input to the user's supplied speech draft and explicitly forbids modifying it. No access to credentials, environment variables, or unrelated files is requested anywhere in the package. SKILL.md:20 读取用户原始讲稿，不修改原稿内容。 |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawhub.ai | not in the service index | skill-card.md:7 |
| fonts.loli.net | not in the service index | assets/template.html:12 |
| lf26-cdn-tos.bytecdntp.com | not in the service index | assets/template.html:9 |
| s1.hdslb.com | not in the service index | references/design-spec.md:39 |
| Binaries invoked | none |
| Environment variables read | none |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 2 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 84 | ccb5f7210040e5f1… |
_meta.json | 6 | 2f57f957f27d0115… |
agents/openai.yaml | 4 | 34339ed6a8bfd7e7… |
assets/template.html | 304 | 3213560e16e3d320… |
references/design-spec.md | 116 | f8e58d710c6a6364… |
references/slide-types.md | 184 | 9898344bcf001034… |
skill-card.md | 43 | 86728d3e6f315f78… |
For agents
JSON: https://agenteconomy.report/k/ppt-generator.audit.json · badge: https://agenteconomy.report/k/ppt-generator.audited.svg ·
skill rating: /k/ppt-generator · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).