Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward remote Typst and LaTeX compiler, but users should understand that document contents are sent to an external API.
Install only if you are comfortable sending the Typst or LaTeX source, auxiliary files, and embedded images you compile to the external TypeTex/Modal API. Avoid using it for secrets, confidential business documents, personal data, or regulated material unless you have separately accepted that service's privacy and retention posture.
The skill performs network access to an external compilation service and its examples also read local files, yet the manifest declares no explicit tool scope such as network or file permissions. This creates a transparency and governance gap: agents or reviewers cannot easily tell that using the skill may access local content and transmit it off-platform.
The skill description explains compilation features but omits an upfront warning that document source, included files, and images are sent to a third-party API. Because these documents may contain proprietary, personal, or secret material, the missing disclosure can cause unintentional data exfiltration during normal use.
This duplicate finding identifies the same external POST in the Typst example. It represents the same trust-boundary crossing where user-supplied document content is sent to a third-party service.
import requests
import base64
response = requests.post(
"https://studio-intrinsic--typetex-compile-app.modal.run/public/compile/typst",
json={
"content": """
This duplicate finding identifies the same external POST in the Typst example. It represents the same trust-boundary crossing where user-supplied document content is sent to a third-party service.
import requests
import base64
response = requests.post(
"https://studio-intrinsic--typetex-compile-app.modal.run/public/compile/typst",
json={
"content": """
This duplicate finding again captures the LaTeX example's outbound transmission of source text to a remote API. The risk remains unauthorized or unexpected disclosure of sensitive document contents.
import requests
import base64
response = requests.post(
"https://studio-intrinsic--typetex-compile-app.modal.run/public/compile/latex",
json={
"content": r"""
This duplicate finding again captures the LaTeX example's outbound transmission of source text to a remote API. The risk remains unauthorized or unexpected disclosure of sensitive document contents.
import requests
import base64
response = requests.post(
"https://studio-intrinsic--typetex-compile-app.modal.run/public/compile/latex",
json={
"content": r"""
This duplicate finding again flags the multi-file upload example where auxiliary files accompany the main document to a remote service. The danger is broader-than-expected data exposure across all project files.
import requests
import base64
response = requests.post(
"https://studio-intrinsic--typetex-compile-app.modal.run/public/compile/typst",
json={
"content": """
This duplicate finding again flags the multi-file upload example where auxiliary files accompany the main document to a remote service. The danger is broader-than-expected data exposure across all project files.
import requests
import base64
response = requests.post(
"https://studio-intrinsic--typetex-compile-app.modal.run/public/compile/typst",
json={
"content": """
This duplicate finding again captures the local-file-to-remote-upload flow in the image example. The practical risk is accidental exfiltration of local file contents to the third-party API.
with open("figure.png", "rb") as f:
image_base64 = base64.b64encode(f.read()).decode("utf-8")
response = requests.post(
"https://studio-intrinsic--typetex-compile-app.modal.run/public/compile/typst",
json={
"content": """
This duplicate finding again captures the local-file-to-remote-upload flow in the image example. The practical risk is accidental exfiltration of local file contents to the third-party API.
with open("figure.png", "rb") as f:
image_base64 = base64.b64encode(f.read()).decode("utf-8")
response = requests.post(
"https://studio-intrinsic--typetex-compile-app.modal.run/public/compile/typst",
json={
"content": """
The curl example posts document content directly to the external compile service from the command line. This is a real disclosure risk because users may copy the pattern for sensitive documents without any accompanying warning about third-party transmission.
)
### Using curl
```bash
# Typst compilation
This curl example for LaTeX likewise transmits full source text to a remote API. Since command-line snippets are often copied verbatim, missing warnings increase the chance of accidental exposure of confidential material.
}' | jq -r '.pdf_base64' | base64 -d > output.pdf
# LaTeX compilation
curl -X POST https://studio-intrinsic--typetex-compile-app.modal.run/public/compile/latex \
-H "Content-Type: application/json" \
-d '{
"content": "\\documentclass{article}\n\\begin{document}\nHello World\n\\end{document}",
This POST request sends user-supplied LaTeX content to an external endpoint, which is a genuine data exfiltration surface even if it is the intended product behavior. In the context of a compiler skill, remote transmission is expected, but it is still security-relevant because documents often contain sensitive information and the example does not emphasize that risk.
Returns:
True if successful, False otherwise
"""
response = requests.post(
API_URL,
json={
"content": content,
The script transmits the full LaTeX source to a third-party public API for compilation, but the example does not clearly warn the user that document contents leave the local environment. That creates a real confidentiality risk because source documents may contain proprietary, personal, or sensitive material, and users may reasonably assume compilation is local from the function name and workflow.
The code performs an outbound HTTP request to a public endpoint and includes the full document content in the JSON body. In the context of a compiler utility, external transmission is expected functionality, but it still creates a real confidentiality risk when handling sensitive source documents, especially since the example does not emphasize that compilation occurs on remote infrastructure.
Returns:
True if successful, False otherwise
"""
response = requests.post(
API_URL,
json={
"content": content,
The script sends arbitrary Typst source content to a third-party public API for compilation, but it does not provide an explicit warning, consent step, or privacy notice before transmitting user-supplied document contents. This is dangerous because users may compile sensitive or proprietary documents under the assumption processing is local, leading to unintended disclosure to an external service.
The manifest describes a public unauthenticated compile API but omits a clear user-facing warning that all submitted Typst/LaTeX source and auxiliary files are transmitted to a remote third-party service. Because documents may contain proprietary text, credentials, internal paths, embedded assets, or sensitive research content, this omission creates a real confidentiality and privacy risk in the context of a document-compilation skill.
The API description states that the compile service is public and requires no authentication, but it does not define any scope constraints, usage boundaries, or safety limitations. In a skill that transmits arbitrary document source to a remote compiler, this broad availability language can mislead users or agents into treating the service as generally safe for any content, increasing the chance that sensitive documents are sent to an unrestricted third-party endpoint.
No suspicious patterns detected.