Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/microsoft/hve-core/powerpointnpx skills add microsoft/hve-core --skill powerpointgit clone --depth 1 https://github.com/microsoft/hve-coreWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00021 | $0.03745 |
| Opus 5 | $0.00010 | $0.01872 |
| Sonnet 5 | $0.00004 | $0.00749 |
| Haiku 4.5 | $0.00002 | $0.00375 |
Grade F, and why
powerpoint scanned grade F with 4 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
sudo apt-get install libreoffice poppler-utils Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -LsSf https://astral.sh/uv/install.sh | sh Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf .venv Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -LsSf https://astral.sh/uv/install.sh | sh How it starts
The opening of the file, as written. The whole thing — 262 lines — stays where its author put it; the contents beside it link to each section on GitHub.
PowerPoint Skill
Generates, updates, and manages PowerPoint slide decks using python-pptx with YAML-driven content and styling definitions.
Overview
This skill provides Python scripts that consume YAML configuration files to produce PowerPoint slide decks. Each slide is defined by a content.yaml file describing its layout, text, and shapes. A style.yaml file defines dimensions, template configuration, layout mappings, metadata, and defaults.
SKILL.md covers technical reference: prerequisites, commands, script architecture, API constraints, and troubleshooting. For conventions and design rules (element positioning, visual quality, color and contrast, contextual styling), follow pptx.instructions.md.
Prerequisites
PowerShell
The Invoke-PptxPipeline.ps1 script handles virtual environment creation and dependency installation automatically via uv sync. Requires uv, Python 3.11+, and PowerShell 7+.
Installing uv
If uv is not installed:
# macOS / Linux
curl -LsSf https://astral.sh/uv/install.sh | sh
# Windows
powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"
# Via pip (fallback)
pip install uv
System Dependencies (Export and Validation)
The Export and Validate actions require LibreOffice for PPTX-to-PDF conversion and optionally pdftoppm from poppler for PDF-to-JPG rendering. When pdftoppm is not available, PyMuPDF handles the image rendering.
The Validate action's vision-based checks require the GitHub Copilot CLI for model access.
# macOS
brew install --cask libreoffice
brew install poppler # optional, provides pdftoppm
# Linux
sudo apt-get install libreoffice poppler-utils
# Windows (winget preferred, choco fallback)
winget install TheDocumentFoundation.LibreOffice
# choco install libreoffice-still # alternative
# poppler: no winget package; use choco install poppler (optional, provides pdftoppm)
Copilot CLI (Vision Validation)
The validate_slides.py script uses the GitHub Copilot SDK to send slide images to vision-capable models. The Copilot CLI must be installed and authenticated:
What ships with it
60 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- content-extra-py-template.md 3.2 KB
- content-yaml-template.md 25 KB
- pyproject.toml 1.5 KB
- references/script-reference.md 15 KB
- scripts/build_deck.py 43 KB runs code
- scripts/embed_audio.py 7.0 KB runs code
- scripts/embed-audio.sh 1.8 KB runs code
- scripts/export_slides.py 8.5 KB runs code
- scripts/export_svg.py 8.2 KB runs code
- scripts/export-svg.sh 1.8 KB runs code
- scripts/extract_content.py 41 KB runs code
- scripts/generate_themes.py 11 KB runs code
- scripts/generate-themes.sh 1.8 KB runs code
- scripts/Invoke-EmbedAudio.ps1 3.8 KB runs code
- scripts/Invoke-ExportSvg.ps1 3.6 KB runs code
- scripts/Invoke-GenerateThemes.ps1 3.7 KB runs code
- scripts/invoke-pptx-pipeline.sh 13 KB runs code
- scripts/Invoke-PptxPipeline.ps1 21 KB runs code
- scripts/pdf_safety.py 5.3 KB runs code
- scripts/pptx_charts.py 5.3 KB runs code
- scripts/pptx_colors.py 4.9 KB runs code
- scripts/pptx_fills.py 14 KB runs code
- scripts/pptx_fonts.py 3.9 KB runs code
- scripts/pptx_shapes.py 2.3 KB runs code
- scripts/pptx_tables.py 6.7 KB runs code
- scripts/pptx_text.py 18 KB runs code
- scripts/pptx_utils.py 1.2 KB runs code
- scripts/render_pdf_images.py 6.0 KB runs code
- scripts/validate_deck.py 12 KB runs code
- scripts/validate_geometry.py 20 KB runs code
- scripts/validate_slides.py 10 KB runs code
- SECURITY.md 25 KB
- style-yaml-template.md 4.7 KB
- tests/conftest.py 8.6 KB runs code
- tests/corpus/0_empty 1 B
- tests/corpus/0_short_hex 3 B
- tests/corpus/0_theme_ref 52 B
- tests/corpus/0_valid_hex 67 B
- tests/corpus/1_empty 1 B
- tests/corpus/1_invalid_hex 11 B
- tests/corpus/1_valid_hex 13 B
- tests/corpus/2_empty_results 5 B
- tests/corpus/2_mixed_severity 16 B
- tests/corpus/3_empty 2 B
- tests/corpus/3_multiple_runs 38 B
- tests/corpus/3_single_run 13 B
- tests/corpus/generate_seeds.py 1.3 KB runs code
- tests/corpus/README.md 1.2 KB
- tests/fixtures/malformed/empty.pdf 0 B
- tests/fixtures/malformed/not_a_pdf.bin 32 B
- tests/fixtures/malformed/truncated.pdf 46 B
- tests/fuzz_harness.py 10 KB runs code
- tests/Invoke-EmbedAudio.Tests.ps1 4.0 KB runs code
- tests/Invoke-ExportSvg.Tests.ps1 3.9 KB runs code
- tests/Invoke-GenerateThemes.Tests.ps1 4.0 KB runs code
- tests/Invoke-PptxPipeline.Tests.ps1 15 KB runs code
- tests/strategies.py 2.4 KB runs code
- tests/test_build_deck.py 69 KB runs code
- tests/test_embed_audio.py 7.3 KB runs code
- tests/test_export_slides.py 13 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 262 lines · 21 tokens per session scan F c42247a9db02
powerpoint is a skill published in the GitHub repository microsoft/hve-core (1,411 stars, last pushed today), licensed MIT. It adds 21 tokens to every session and 3,745 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it F with 4 findings (asks for root, downloads and executes remote code, recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
chat-pet-sprite-creation
Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…
next-cache-components-adoption
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…
babysit-pr
Babysit a GitHub pull request after creation by continuously polling review comments, CI checks/workflow runs, and mergeability state until the PR is merged/closed or user help is required. Diagnose failures, retry likely flaky failures up to 3 times, auto-fix/push branch-related issues when appropriate, and keep…
imagegen
Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output…