Security audit

LaTeX Writer

Security checks for vulnerabilities and agentic risk

Overview

This LaTeX skill is mostly purpose-aligned, but it should be reviewed carefully because it compiles user-controlled content locally without enough escaping or sandboxing.

Use this skill only for trusted document content unless compilation is isolated. Before installing or running it broadly, require explicit user confirmation for PDF compilation, escape or validate all metadata and bibliography fields, and compile in a restricted sandbox without access to secrets, home directories, or unrelated workspace files.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/body_builder.py:91
Finding: Unescaped document metadata allows TeX injection and local file disclosure
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/latex_generator.py:96
Finding: Unescaped bibliography entries allow TeX injection during PDF compilation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The supplied code only implements input parsing and structure extraction. It converts Markdown/JSON/plain text into an internal document representation. There is no code for rendering LaTeX, selecting or filling templates, handling academic/CV/thesis formats, or invoking a LaTeX engine to compile PDFs. This is a material description-to-behavior mismatch because the declared purpose emphasizes document generation and compilation, while the actual code chunk performs only preprocessing/parsing.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The code is broadly consistent with the document-generation portion of the description: it constructs LaTeX preambles, body/bibliography scaffolding, and template-specific settings for several declared document types. However, the declared description explicitly includes automatic PDF compilation, and this code chunk only generates LaTeX source strings and prints a preamble in test code. There is no invocation of pdflatex/xelatex, subprocess execution, file generation, or compilation workflow. No unrelated or suspicious capabilities are present, but the missing compilation capability makes the description materially broader than the observed behavior.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 82% confidence
Finding: The skill advertises implementation components that imply file read/write and shell-based PDF compilation, but it does not declare any explicit tool scope or permission boundaries. In an agent environment, undeclared powerful capabilities increase the risk of over-privileged execution, unsafe file access, and command execution without transparent authorization controls.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger conditions are broad enough that the skill could activate for generic requests about writing, formatting, or PDFs without clear user intent. In a skill with implied file and shell capabilities, unintended invocation raises the chance of processing untrusted content, writing files, or initiating compilation when the user did not explicitly request those actions.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The ModernCV title builder inserts multiple user-controlled fields directly into LaTeX commands without passing them through escape_latex, including name, phone, email, and social handles. In a skill whose purpose is to generate and auto-compile LaTeX, this enables LaTeX command injection and can become arbitrary file read/write or code execution depending on the TeX engine and compiler flags.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: For non-IEEE and non-ACM templates, the code emits \section*{致谢} unconditionally. This imposes a Chinese locale on generated output without offering user opt-in or explaining that the skill is limited to Chinese-language documents.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code invokes a local LaTeX compiler on attacker-controlled LaTeX content via a subprocess. In the context of a document-generation skill, that is dangerous because TeX engines can access local files and, depending on engine/configuration, may enable command execution or other unintended interactions, turning untrusted document input into a local attack surface.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 73% confidence
Finding: The skill prominently advertises Chinese support and includes Chinese-language examples, but this alone does not require a language choice. However, because locale-specific behavior is highlighted without stating that language/template selection is based on user preference, there is some risk of unintended language or locale assumptions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The code includes a special-case chinese_academic mode and unconditionally injects Chinese-specific LaTeX support via ctex when that style is selected. This reflects a locale-specific behavior in natural-language/configuration terms, but the file provides no user-choice mechanism or justification for enforcing that locale within the skill logic.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The code includes Chinese-only comments such as '关键词匹配', '风格匹配', '名称匹配', and '按分数排序'. This imposes a specific language in the skill source without offering any language or locale choice, which matches the policy's language/locale violation criterion.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.