Skills document-generation

📦

document-generation

Name: document-generation
Author: BOHUYESHAN-APB

v1.0.0 Content revision r2 High Risk 📁 Filesystem access🌐 Network access⚙️ External commands

Create Office Documents from Structured Content

Creating consistent office files manually takes time. This skill generates Word, PowerPoint, Excel, and PDF files and extracts text from PDFs.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "document-generation" from https://skillstore.io/skills/bohuyeshan-apb-document-generation.md and its manifest at https://skillstore.io/api/skills/bohuyeshan-apb-document-generation/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/bohuyeshan-apb-document-generation.md Signed manifest GET /api/skills/bohuyeshan-apb-document-generation/manifest Signed lockfile GET /api/skills/bohuyeshan-apb-document-generation/lockfile

Test it

Using "document-generation". Create a Word project update with progress, risks, next steps, and a two-column milestone table.

Expected outcome:

A Word document containing a project title, three concise sections, bullet lists, and a formatted milestone table.

Using "document-generation". Build a six-slide quarterly review from the supplied HTML sections and sales table.

Expected outcome:

A PowerPoint presentation with six titled slides, summarized text, and a chart derived from the sales table.

Using "document-generation". Extract all readable text from the uploaded PDF.

Expected outcome:

Page text returned in reading order, separated with blank lines between extracted pages.

Security Audit

High Risk

v9 • 7/23/2026 Open versioned report

Eleven static alerts are false positives caused by normal output-directory handling, temporary-file cleanup, CSS, comments, and Markdown backticks. Two network alerts are confirmed because image sources can trigger unrestricted HTTP requests. Additional review found output path traversal, local image disclosure, and external resource loading through PDF rendering.

Files scanned

1,031

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (3)

High

scripts/excel_generator.py:32-35 scripts/pdf_generator.py:39-70 scripts/ppt_generator.py:302 scripts/ppt_generator.py:463 scripts/word_generator.py:43 scripts/word_generator.py:289

Output Filename Path Traversal

Generators join caller-supplied filenames to output directories without rejecting absolute paths or parent segments, allowing generated files to overwrite writable paths elsewhere.

Each generator writes to a direct join of its output directory and an unvalidated filename. Pathlib and os.path joins accept parent segments, and absolute names can replace the base path.

Medium

scripts/ppt_generator.py:259-265 scripts/word_generator.py:234-241

Unrestricted Local Image Inclusion

Supplied HTML can reference any accessible local image path, causing its contents to be embedded in generated Word or PowerPoint files.

Both generators test supplied image sources with os.path.exists and pass matching paths directly to document image APIs. No trusted asset root or access check is applied.

Medium

scripts/pdf_generator.py:41-70

Unrestricted PDF External Resource Loading

Supplied HTML is rendered by WeasyPrint without a restrictive resource fetcher, allowing absolute remote or local resources to be requested during PDF generation.

The renderer receives supplied HTML directly and uses its default URL fetcher. Absolute resource references are not filtered before rendering.

Capability review items (2)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

scripts/ppt_generator.py:268

Python HTTP libraries

response = requests.get(url, timeout=10)

The request fetches an image URL taken from supplied HTML without host or address validation. This permits server-side requests to internal destinations and does not limit response size.

Medium

scripts/word_generator.py:246

Python HTTP libraries

resp = requests.get(src)

The request follows an image source from supplied HTML without destination validation, a timeout, or a response-size limit. It can reach internal HTTP services or consume excessive resources.

Risk Factors

📁 Filesystem access (4)

scripts/excel_generator.py:15 scripts/ppt_generator.py:20 scripts/ppt_generator.py:270 scripts/ppt_generator.py:278

🌐 Network access (2)

scripts/ppt_generator.py:268 scripts/word_generator.py:246

⚙️ External commands (4)

SKILL.md:30 SKILL.md:34-47 SKILL.md:47-57 SKILL.md:57-58

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/bohuyeshan-apb-document-generation/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/bohuyeshan-apb-document-generation/security.svg)](https://skillstore.io/skills/bohuyeshan-apb-document-generation?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/bohuyeshan-apb-document-generation?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/bohuyeshan-apb-document-generation/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/bohuyeshan-apb-document-generation.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

BOHUYESHAN-APB. (2026). document-generation security audit report (audit version 9) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/bohuyeshan-apb-document-generation/audits/9

BibTeX citation

@techreport{bohuyeshan-apb-bohuyeshan-apb-document-generation-2026,
  author = {BOHUYESHAN-APB},
  title = {document-generation security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/bohuyeshan-apb-document-generation/audits/9},
  note = {Author version 1.0.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "document-generation security audit report (audit version 9)"
version: "1.0.0"
type: report
authors:
  - name: "BOHUYESHAN-APB"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/bohuyeshan-apb-document-generation/audits/9"
identifiers:
  - type: other
    value: "skillstore:bohuyeshan-apb-document-generation:audit:9"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Prepare Client Reports

Turn approved HTML content into branded Word or PDF reports for review and distribution.

Build Presentation Drafts

Convert structured slide sections into a PowerPoint draft with tables, charts, and supporting images.

Export Operational Data

Write lists of business records to an Excel workbook for analysis or sharing.

Try These Prompts

Create a Simple Report

Create a Word report named [filename] with a title, introduction, three sections, bullet points, and a conclusion using this content: [content].

Build a Slide Deck

Create a PowerPoint named [filename] with [slide count] slides from [content]. Include concise titles, supporting points, and tables where relevant.

Export Records to Excel

Create an Excel workbook named [filename] from these records: [records]. Preserve field names as columns and keep one record per row.

Produce a Multi-Format Package

Generate Word, PDF, and PowerPoint versions of [content]. Use consistent section names, adapt layouts by format, and report every output path.

Best Practices

Use simple filenames and keep every output inside a dedicated document directory.
Provide concise, structured HTML with clear headings and moderate content per slide.
Review generated files for layout, image quality, and sensitive information before distribution.