md2pdf-xelatex

• Analyzed: May 12, 2026, 4:28 AM
• Findings: 1
• Version: 1.0.0
• Hash: 1c3952237e9a335161f25bc180b6f6dcf29cb387e9f5f57ab1aacdf6a0816071
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is designed for a legitimate purpose (Markdown to PDF conversion). However, the `scripts/md2pdf.sh` script is vulnerable to LaTeX injection. User-controlled arguments, specifically `--toc-title`, are directly incorporated into the LaTeX header via `pandoc -V "toc-title=$TOC_TITLE"`. A malicious user could inject arbitrary LaTeX commands, potentially leading to arbitrary file reads or even remote code execution if the underlying XeLaTeX engine has `\write18` enabled. This constitutes a significant vulnerability, classifying the skill as suspicious rather than benign, despite the lack of clear malicious intent within the script itself.