ClawHub
Back to skill

Security audit

Compile LaTex & Typst into PDF with TypeTex

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward remote Typst and LaTeX PDF compiler, but users should avoid sending sensitive documents unless they trust the external TypeTex API.

Use this for public or low-sensitivity documents. Before installing or using it, understand that Typst/LaTeX source, auxiliary files, images, and possibly compiler logs may be sent to the external TypeTex API; do not upload confidential manuscripts, proprietary assets, secrets, regulated data, or client material without approval.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (15)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill declares no required permissions or capabilities, yet its documented behavior clearly involves reading local files (for image/examples) and transmitting document content to a remote service. This mismatch can mislead users and security controls about what the skill actually does, reducing informed consent and weakening policy enforcement.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill description does not clearly warn that source documents and auxiliary files are sent to a third-party compilation API. Users may provide sensitive LaTeX/Typst content, embedded data, or proprietary images under the assumption compilation is local, causing unintended data disclosure.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The script transmits arbitrary LaTeX source to a third-party remote compilation service, but the example does not clearly warn users that document contents leave the local machine. LaTeX sources often contain unpublished papers, credentials, internal paths, embedded data, or proprietary content, so silent remote transmission creates a real confidentiality and compliance risk even though the transport uses HTTPS.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The script transmits the full Typst document content to a public remote compilation API, but it provides no explicit warning, consent flow, or privacy notice to the user at the point of use. This is dangerous because users may compile sensitive or proprietary documents under the assumption processing is local, causing unintended disclosure of confidential content to a third party.

External Transmission

Medium
Category
Data Exfiltration
Content
import requests
import base64

response = requests.post(
    "https://studio-intrinsic--typetex-compile-app.modal.run/public/compile/typst",
    json={
        "content": """
Confidence
92% confidence
Finding
This example shows user-supplied document content being POSTed to an external endpoint, which is a real data egress path. Even though it is the core purpose of the skill, it is dangerous if users are not clearly informed that potentially sensitive document contents leave the local environment.

External Transmission

Medium
Category
Data Exfiltration
Content
import requests
import base64

response = requests.post(
    "https://studio-intrinsic--typetex-compile-app.modal.run/public/compile/latex",
    json={
        "content": r"""
Confidence
92% confidence
Finding
The LaTeX compile example transmits raw source text to a remote compilation service. LaTeX sources often contain unpublished research, credentials accidentally pasted into documents, or internal file references, so sending them externally can create confidentiality risk.

External Transmission

Medium
Category
Data Exfiltration
Content
import requests
import base64

response = requests.post(
    "https://studio-intrinsic--typetex-compile-app.modal.run/public/compile/typst",
    json={
        "content": """
Confidence
93% confidence
Finding
The multi-file Typst example sends both the main document and auxiliary files to an external API, increasing the volume and sensitivity of data disclosed. Included files can contain templates, proprietary content, or other internal materials that users may not realize are being uploaded.

External Transmission

Medium
Category
Data Exfiltration
Content
with open("figure.png", "rb") as f:
    image_base64 = base64.b64encode(f.read()).decode("utf-8")

response = requests.post(
    "https://studio-intrinsic--typetex-compile-app.modal.run/public/compile/typst",
    json={
        "content": """
Confidence
94% confidence
Finding
This example reads a local image and base64-encodes it for upload to the remote compiler, creating a direct path for local file contents to leave the environment. If generalized by an agent, similar patterns could upload sensitive local files under the guise of document compilation.

External Transmission

Medium
Category
Data Exfiltration
Content
import requests
import base64

response = requests.post(
    "https://studio-intrinsic--typetex-compile-app.modal.run/public/compile/typst",
    json={
        "content": """
Confidence
92% confidence
Finding
This example shows user-supplied document content being POSTed to an external endpoint, which is a real data egress path. Even though it is the core purpose of the skill, it is dangerous if users are not clearly informed that potentially sensitive document contents leave the local environment.

External Transmission

Medium
Category
Data Exfiltration
Content
import requests
import base64

response = requests.post(
    "https://studio-intrinsic--typetex-compile-app.modal.run/public/compile/latex",
    json={
        "content": r"""
Confidence
92% confidence
Finding
The LaTeX compile example transmits raw source text to a remote compilation service. LaTeX sources often contain unpublished research, credentials accidentally pasted into documents, or internal file references, so sending them externally can create confidentiality risk.

External Transmission

Medium
Category
Data Exfiltration
Content
import requests
import base64

response = requests.post(
    "https://studio-intrinsic--typetex-compile-app.modal.run/public/compile/typst",
    json={
        "content": """
Confidence
93% confidence
Finding
The multi-file Typst example sends both the main document and auxiliary files to an external API, increasing the volume and sensitivity of data disclosed. Included files can contain templates, proprietary content, or other internal materials that users may not realize are being uploaded.

External Transmission

Medium
Category
Data Exfiltration
Content
with open("figure.png", "rb") as f:
    image_base64 = base64.b64encode(f.read()).decode("utf-8")

response = requests.post(
    "https://studio-intrinsic--typetex-compile-app.modal.run/public/compile/typst",
    json={
        "content": """
Confidence
94% confidence
Finding
This example reads a local image and base64-encodes it for upload to the remote compiler, creating a direct path for local file contents to leave the environment. If generalized by an agent, similar patterns could upload sensitive local files under the guise of document compilation.

External Transmission

Medium
Category
Data Exfiltration
Content
}' | jq -r '.pdf_base64' | base64 -d > output.pdf

# LaTeX compilation
curl -X POST https://studio-intrinsic--typetex-compile-app.modal.run/public/compile/latex \
  -H "Content-Type: application/json" \
  -d '{
    "content": "\\documentclass{article}\n\\begin{document}\nHello World\n\\end{document}",
Confidence
90% confidence
Finding
The curl example also sends LaTeX source to the remote service, reinforcing that external transmission is a built-in behavior of the skill. Because the skill lacks upfront warning, command-line examples like this may normalize uploading sensitive content without informed consent.

External Transmission

Medium
Category
Data Exfiltration
Content
Returns:
        True if successful, False otherwise
    """
    response = requests.post(
        API_URL,
        json={
            "content": content,
Confidence
92% confidence
Finding
This POST request sends user-supplied document content to an external API endpoint for processing. In the context of a compiler skill, that behavior is expected, but it is still security-relevant because sensitive source material is exfiltrated to a remote service and may be logged, retained, or exposed by the provider.

External Transmission

Medium
Category
Data Exfiltration
Content
Returns:
        True if successful, False otherwise
    """
    response = requests.post(
        API_URL,
        json={
            "content": content,
Confidence
92% confidence
Finding
The code performs an outbound HTTP POST to a public service and includes user-supplied document content in the JSON body. In the context of a compiler helper, this creates a real data exfiltration risk if users provide sensitive source files, especially because the example reads arbitrary local files and forwards them without any security gating or disclosure.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.