Arbitrary file writes via unchecked output path

Path traversal in PPTAgent before commit 418491a allows remote authenticated users to write image files outside the workspace. The markdown_table_to_image tool forwards a caller-controlled path to get_html_table_image, which creates parent directories and saves a rendered image without verifying that the resolved path remains under the active workspace. Exploitation requires low-privileged access to the tool and user interaction; successful writes can create directories or overwrite writable files.