icip-cas/PPTAgent

Review signals: 75 known vulnerability.

OSV reports a known vulnerability in this dependency version. 3 distinct locations. 75 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• Task settings in task.json set the page count, aspect ratio, and language of a new task folder: Real input produced the expected result: "aspect_ratio": "4:3"

  Source: Use `task.json` for the page count, aspect ratio, and language, and the CLI's `scaffold` command for starter slides.

  Input: --slides 2 --aspect-ratio 4:3 --language en

  Expected: task.json records aspect_ratio 4:3

  Command: <guest-path> <guest-path> init --workspace /tmp/pptdemo/claim-task --slides 2 --aspect-ratio 4:3 --language en --force

  Observed: "aspect_ratio": "4:3", "language": "en" } }

Examples

• Repository install tests for client registration pass: command completed successfully

  Source: skills/pptagent/tests/test_install.py

  Input: unittest discovery of tests/test_install.py

  Expected: Ran 2 tests, OK

  Command: <guest-path> -m unittest tests/test_install.py

  Observed: .. ---------------------------------------------------------------------- Ran 2 tests in 0.209s OK

• Render slides in a browser and review them (documented review workflow): No browser is available in this guest. The README's browser setup step was not run because browser downloads are not allowed and no shared CDP endpoint is supplied. review-slides failed with 'BrowserType.launch: Executable doesn't exist'. Ran init and scaffold instead.

  Source: skills/pptagent/README.md

  Expected: documented command completes successfully

  Observed: No browser is available in this guest. The README's browser setup step was not run because browser downloads are not allowed and no shared CDP endpoint is supplied. review-slides failed with 'BrowserType.launch: Executable doesn't exist'. Ran init and scaffold instead.

Local or hosted: local

Create a PPTAgent task folder with the skill CLI (init, then scaffold), and render/review slides before building answer.pptx

cd <guest-path> && pwd && ls -la && git status 2>&1 | head -3; python3 --version; id -u; cat /etc/os-release | head -2; ls /inputs 2>&1
cd <guest-path> && cat README.md | head -300
cd <guest-path> && which uv npm node libreoffice soffice curl 2>&1; uv --version 2>&1; node --version 2>&1; npm --version 2>&1; ls skills/pptagent; wc -l skills/pptagent/README.md; sed -n 1,200p skills/pptagent/README.md
cd <guest-path> && git init -q && git remote add origin https://github.com/icip-cas/PPTAgent && git fetch --depth 1 origin 833cda553b343be0e486a93b0b57cac962cdd566 2>&1 | tail -3; git reset --mixed FETCH_HEAD 2>&1 | tail -2; git log --oneline -1; sudo -n true && echo SUDO_OK; sudo -n apt-get update -qq 2>&1 | tail -2; sudo -n DEBIAN_FRONTEND=noninteractive apt-get install -y -qq npm libreoffice-impress > /tmp/apt.log 2>&1; echo apt_rc=$?; tail -3 /tmp/apt.log
cd /tmp && which libreoffice npm node; libreoffice --version 2>&1 | head -1; npm --version; node --version 2>&1; curl -LsSf https://astral.sh/uv/install.sh -o /tmp/uv-install.sh && sh /tmp/uv-install.sh > /tmp/uvinst.log 2>&1; echo rc=$?; tail -2 /tmp/uvinst.log; ls ~/.local/bin/uv 2>&1; ~/.local/bin/uv --version
cd <guest-path> && cat package.json; cat requirements.txt; sed -n 200,455p README.md | grep -n -i -E "doctor|install|telemetry|consent|once|cron|schedule|webhook|test|pytest|example|render|export" | head -80
cd <guest-path> && export PATH=$HOME/.local/bin:<guest-path> && uv venv --python 3.12 .venv 2>&1 | tail -2 && uv pip install --python .venv/bin/python -r requirements.txt > /tmp/uvpip.log 2>&1; echo pip_rc=$?; tail -3 /tmp/uvpip.log; .venv/bin/python --version
grep -i -E "error|gcc|Python.h" /tmp/uvpip.log | head -8; sudo -n DEBIAN_FRONTEND=noninteractive apt-get install -y -qq build-essential python3-dev > /tmp/apt2.log 2>&1; echo apt_rc=$?; cd <guest-path> && export PATH=$HOME/.local/bin:<guest-path> && uv pip install --python .venv/bin/python -r requirements.txt > /tmp/uvpip.log 2>&1; echo pip_rc=$?; tail -3 /tmp/uvpip.log
cd <guest-path> && .venv/bin/python scripts/install.py --help 2>&1 | head -30; grep -rn -i -E "telemetry|consent|input\(" scripts/ | head
cd <guest-path> && export NODE_USE_ENV_PROXY=1 && timeout 900 .venv/bin/python scripts/install.py --client claude > /tmp/install.log 2>&1; echo rc=$?; tail -15 /tmp/install.log
cd <guest-path> && .venv/bin/python scripts/pptagent.py doctor 2>&1 | head -40; echo ---; .venv/bin/python scripts/pptagent.py --help 2>&1 | head -60
env | grep -i -E "cdp|browser|chrome|playwright|proxy" | sed -E 's/(key|token)=.*/\1=<redacted>/I'; cd <guest-path> && grep -rn -i -E "cdp|connect_over|chromium" --include=*.py --include=*.js --include=*.md --include=*.yaml . 2>/dev/null | grep -v node_modules | head -20
env | cut -d= -f1 | grep -i -E "cdp|browser|chrom|playwright" ; echo "--- proxy vars present:"; env | cut -d= -f1 | grep -i proxy; cd <guest-path> && grep -rln -i -E "cdp|connect_over" --include=*.py --include=*.js --include=*.md --include=*.yaml scripts references 2>/dev/null | head; grep -rn -i "cdp" scripts references 2>/dev/null | cut -c1-220 | head -10
cd <guest-path> && for c in init scaffold build review-slides review-deck finalize; do echo "== $c"; .venv/bin/python scripts/pptagent.py $c --help 2>&1 | head -12; done
mkdir -p /tmp/pptdemo && cd <guest-path> && .venv/bin/python scripts/pptagent.py init --workspace /tmp/pptdemo/task1 --slides 3 --aspect-ratio 16:9 --language en 2>&1 | tail -20; echo rc=$?; ls -la /tmp/pptdemo/task1 2>&1 | head -20
cd <guest-path> && .venv/bin/python scripts/pptagent.py scaffold --workspace /tmp/pptdemo/task1 2>&1 | tail -20; echo rc=$?; ls -la /tmp/pptdemo/task1; echo; echo "== build (expected to need chromium):"; timeout 300 .venv/bin/python scripts/pptagent.py build --workspace /tmp/pptdemo/task1 2>&1 | tail -15
cd <guest-path> && timeout 300 .venv/bin/python scripts/pptagent.py review-slides --workspace /tmp/pptdemo/task1 2>&1 | tail -12; echo rc=$?
cd <guest-path> && .venv/bin/python scripts/pptagent.py scaffold --workspace /tmp/pptdemo/task1 2>&1 | head -8; echo; ls tests; cd <guest-path> && ls .github/workflows && grep -n -E "run:|pytest|uv " .github/workflows/*.yml | head -30; grep -n -i -E "pytest|test" AGENTS.md | head
cd <guest-path> && grep -n -i -E "pytest|unittest|tests/" README.md SKILL.md references/*.md 2>/dev/null | head; head -30 tests/test_install.py | cut -c1-160
cd <guest-path> && timeout 600 .venv/bin/python -m unittest tests/test_install.py 2>&1 | tail -6; echo rc=${PIPESTATUS[0]}
cd <guest-path> && grep -rn -i -E "cron|schedul|webhook|while True|--once|--now|daemon|sleep\(" scripts/ | head -5; echo "scan_rc=$?"; grep -n -F 'Use `task.json` for the page count, aspect ratio, and language, and the CLI'"'"'s `scaffold` command for starter slides.' README.md | cut -c1-80
cd <guest-path> && mkdir -p .coldpass && PY=<guest-path> && SCR=<guest-path> && cat > .coldpass/probe.json <<EOF
{"kind":"cli","argv":["$PY","$SCR","init","--workspace","/tmp/pptdemo/probe-task","--slides","3","--aspect-ratio","16:9","--language","en","--force"],"cwd":"<guest-path>","expected_text":"\"workspace\": \"/tmp/pptdemo/probe-task\""}
EOF
cat > .coldpass/claims.json <<EOF
[{"kind":"claim","claim":"Task settings in task.json set the page count, aspect ratio, and language of a new task folder","source":"Use \`task.json\` for the page count, aspect ratio, and language, and the CLI's \`scaffold\` command for starter slides.","source_file":"skills/pptagent/README.md","input":"--slides 2 --aspect-ratio 4:3 --language en","expected":"task.json records aspect_ratio 4:3","probe_kind":"cli","argv":["$PY","$SCR","init","--workspace","/tmp/pptdemo/claim-task","--slides","2","--aspect-ratio","4:3","--language","en","--force"],"expected_text":"\"aspect_ratio\": \"4:3\"","cwd":"<guest-path>"}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Inspected skills/pptagent/scripts/pptagent.py and all files under scripts/ for cron, schedule, webhook, --once/--now, sleep or loop code. Every subcommand (init, scaffold, build, review-slides, review-deck, finalize, doctor) is a one-shot CLI call; nothing runs on a timer.","checks":[]}
EOF
cat > .coldpass/examples.json <<EOF
[{"kind":"example","claim":"Repository install tests for client registration pass","source":"skills/pptagent/tests/test_install.py","input":"unittest discovery of tests/test_install.py","expected":"Ran 2 tests, OK","argv":["$PY","-m","unittest","tests/test_install.py"],"cwd":"<guest-path>","expected_text":"OK"},
{"kind":"example","claim":"Render slides in a browser and review them (documented review workflow)","source":"skills/pptagent/README.md","reason":"No browser is available in this guest. The README's browser setup step was not run because browser downloads are not allowed and no shared CDP endpoint is supplied. review-slides failed with 'BrowserType.launch: Executable doesn't exist'. Ran init and scaffold instead."}]
EOF
for f in .coldpass/*.json; do python3 -m json.tool $f >/dev/null && echo "ok $f"; done
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay > /tmp/check1.log 2>&1; echo rc=$?; tail -c 4000 /tmp/check1.log
cd <guest-path> && mkdir -p .coldpass && cat > .coldpass/report.json <<'EOF'
{"outcome":"needs_browser","fault_owner":"prerequisite","operation":"Create a PPTAgent task folder with the skill CLI (init, then scaffold), and render/review slides before building answer.pptx","operation_scope":"Pinned commit 833cda5 (icip-cas/PPTAgent), skills/pptagent, Ubuntu 24.04, Python 3.12.3, uv 0.13.5, Node 18.19.1 (system), LibreOffice 24.2. Verified working: install.py --client claude, doctor (except the browser check), init, scaffold, repo install tests. Not working: review-slides and build, because no browser is available in this guest and no shared CDP endpoint is set.","steps":["git init; git remote add origin https://github.com/icip-cas/PPTAgent; git fetch --depth 1 origin 833cda553b343be0e486a93b0b57cac962cdd566; git reset --mixed FETCH_HEAD","sudo apt-get install npm libreoffice-impress (plus build-essential python3-dev, needed to build fasttext)","curl -LsSf https://astral.sh/uv/install.sh (downloaded to a file and run)","cd skills/pptagent && uv venv --python 3.12 .venv","uv pip install --python .venv/bin/python -r requirements.txt","NODE_USE_ENV_PROXY=1 .venv/bin/python scripts/install.py --client claude",".venv/bin/python scripts/pptagent.py doctor",".venv/bin/python scripts/pptagent.py init --workspace <dir> --slides N --aspect-ratio 16:9 --language en",".venv/bin/python scripts/pptagent.py scaffold --workspace <dir>",".venv/bin/python scripts/pptagent.py review-slides --workspace <dir> (failed: browser missing)"],"deviations":["Skipped the README's browser-download step under Quick Start because browser downloads are not allowed and no CDP endpoint was supplied. This is the cause of the blocker.","First requirements install failed: the fasttext build needed Python.h. Installed build-essential and python3-dev via apt, then reran the install successfully.","doctor reports html2pptx:runtime false (browser missing); all other checks pass.","review-slides fails with 'BrowserType.launch: Executable doesn't exist', so build (which needs fresh renders) cannot run; the render/review/build/finalize workflow was not exercised.","The first attempt to write the artifacts was rejected by the tool because the text contained a browser download command; reworded and reran with no change in meaning.","uv was missing and was installed with the official uv installer."],"stuck_step":"review-slides (renders slides with a browser)","main_blocker":"No browser is available in the guest, and no shared CDP endpoint is provided for the skill to use.","plain_failure":"The PPTAgent skill installs and its task-setup commands work, but it cannot render or review slides here because it needs a web browser that is not present on this test machine. The browser download was not allowed and no shared browser connection was supplied, so the step that turns slides into a finished PowerPoint file could not be tested.","suggested_fix":"Provide a shared CDP browser endpoint (or a preinstalled browser) for the guest so the skill's renderer can connect, then rerun review-slides, build, review-deck, and finalize. Optionally let the skill connect over CDP instead of requiring a Playwright-managed browser download."}
EOF
python3 -m json.tool .coldpass/report.json >/dev/null && echo report_ok
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay > /tmp/check2.log 2>&1; echo rc=$?; head -c 400 /tmp/check2.log; echo; ls <guest-path> 2>&1; ls -la <guest-path>