PPTAgent

The system utilizes subprocess calls (e.g., `soffice`) for file conversions, which are generally safe when inputs are controlled. However, PDF parsing relies on an external `MINERU_API` endpoint, meaning document content is sent to a third-party service, which is a significant privacy/security consideration. The FastAPI server's CORS policy is set to `allow_origins=["*"]`, which is overly permissive for production environments. While the `CodeExecutor` executes LLM-generated API calls only for internal slide manipulation, there's always a theoretical risk with agentic code generation in complex scenarios, though the exposed APIs appear limited in scope to PPT objects.