T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/writer_tools.py:11- Finding
Unrestricted Filesystem Read Through Reference Reader
- Content
View full analysis
- Remediation
View remediation
Security audit
Academic Writer
Security checks for vulnerabilities and agentic risk
Overview
This LaTeX writing skill appears purpose-built rather than malicious, but it needs Review because its helper can read and overwrite arbitrary paths and its setup asks for privileged host package installs.
Install only in an isolated project workspace or container/VM, review any sudo package installation separately, and do not let the skill read or compile untrusted paths. Before use, constrain read_reference, scan_template, write_latex, and compile_pdf to trusted project files, add overwrite confirmation, and pin dependencies.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/writer_tools.py:51- Finding
Arbitrary File Overwrite or Append Through LaTeX Writer
- Content
View full analysis
``` 5. Python opens the target under the permissions of the skill process. 6. Existing contents are overwritten or attacker-controlled text is appended. ### Impact Assessment The attacker can modify any file writable by the skill process. This may corrupt documents, source files, local configuration, or other user-owned data. If the process can write to files interpreted or executed by another component ...[truncated 272 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
SKILL.md:48- Finding
Unpinned Third-Party Python Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (11)
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 97% confidence
- Finding
This skill reads arbitrary local files via
read_referenceandscan_template, but its declared permissions only mentionshell:exec, not file read access. That mismatch is dangerous because users and policy systems may underestimate the skill's ability to access sensitive local data, especially since the skill is explicitly designed to ingest reference materials and scan directories.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md --- name: academic-writer description: "Professional LaTeX writing assistant. Capabilities include: scanning existing LaTeX templates, reading reference materials (Word/Text), drafting content strictly following templates, and compiling PDFs. Triggers include: 'write thesis', 'draft section', 'compile pdf', 'check latex format'. Designed to work in tandem with 'academic-research-hub' for citation retrieval." license: Proprietary permissions: - shell:exec
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest description lists triggers such as 'write thesis' and 'draft section', which are generic phrases that could appear in ordinary conversation outside a narrowly scoped LaTeX-skill invocation. The file does not provide exclusion conditions or negative examples to clarify when these triggers should or should not activate the skill.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 91% confidence
- Finding
The skill instructs the operator to run privileged package-management commands with sudo, which introduces unnecessary trust in the skill content and can modify the host system outside the skill sandbox. In a shell:exec-enabled skill, normalizing root-level setup steps increases risk because users may execute them without independently validating what is being installed and why.
- Content
bash # Update package lists sudo apt-get update # Install the full TeX Live distribution (Required for all templates) # Warning: This download is approx 4GB-7GB
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 94% confidence
- Finding
Recommending 'sudo apt-get install texlive-full' is particularly risky because it performs a large privileged installation on the host and expands the trusted software base significantly. Even if the package is legitimate, embedding root-level installation guidance in a skill with shell execution makes host compromise or unsafe operator behavior more likely if the pattern is copied for other dependencies.
- Content
md # Install the full TeX Live distribution (Required for all templates) # Warning: This download is approx 4GB-7GB sudo apt-get install texlive-full # Install latexmk for automated compilation sudo apt-get install latexmk
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
This line again directs the user to perform a privileged package installation with sudo, which can alter the host environment and conditions users to accept administrative commands from skill content. While latexmk itself is not inherently malicious, the dangerous pattern is the skill encouraging elevated execution on the local machine.
- Content
sudo apt-get install texlive-full
Install latexmk for automated compilation
sudo apt-get install latexmk
text ### 2. Python Environment & Dependencies
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 84% confidence
- Finding
The troubleshooting section reinforces the same unsafe pattern by telling users to resolve errors with privileged installation commands. Repetition matters because it increases the chance that operators will run root-level commands reflexively during failure handling, when scrutiny is typically lower.
- Content
md ### Compilation Failures * **Error:** `latexmk: command not found` * **Fix:** Ensure you ran `sudo apt-get install latexmk`. * **Error:** `! LaTeX Error: File 'article.cls' not found.` * **Fix:** Ensure you ran `sudo apt-get install texlive-full`. * **Error:** `! Package citation Error`
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 84% confidence
- Finding
This line again normalizes sudo-based package installation as an inline fix, extending host-level modification into routine troubleshooting. In the context of an agent skill that can read/write files and compile content, any encouragement of elevated host actions meaningfully increases operational risk.
- Content
md * **Error:** `latexmk: command not found` * **Fix:** Ensure you ran `sudo apt-get install latexmk`. * **Error:** `! LaTeX Error: File 'article.cls' not found.` * **Fix:** Ensure you ran `sudo apt-get install texlive-full`. * **Error:** `! Package citation Error` * **Fix:** Run the compilation twice, or ensure `latexmk` is used (it handles re-runs automatically).
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
write_latex_contentwrites arbitrary content to an arbitrary path with no confirmation, path validation, or workspace restriction. In a skill with shell execution and document-compilation features, this can be used to overwrite existing files, plant malicious.texor auxiliary files, or modify scripts/configuration within the accessible environment.- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python return "Error: No main file specified." # 检查 latexmk 是否存在 if subprocess.call(["which", "latexmk"], stdout=subprocess.DEVNULL) != 0: return "Error: latexmk not found. Please install texlive-full." try:
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 95% confidence
- Finding
The skill invokes
latexmkon a user-supplied.texfile, which causes execution of a powerful external toolchain over attacker-controlled input. In the context of LaTeX, compilation can trigger dangerous behaviors such as file reads, command execution depending on TeX configuration, or abuse of the shell-exec permission to operate on local files; the 60-second timeout does not meaningfully prevent data exposure or side effects.- Content
python try: # -interaction=nonstopmode: 不因错误暂停 # -pdf: 生成 PDF result = subprocess.run( ['latexmk', '-pdf', '-interaction=nonstopmode', main_file], stdout=subprocess.PIPE, stderr=subprocess.PIPE,
Static analysis
No suspicious patterns detected.