latex-scaffold

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:45 PM UTC
• Version:
  1.0.0

Overview

This skill is a narrowly scoped LaTeX project helper; it can create .tex snippets in a chosen project's assets folder and optionally points users to an external IEEE template download.

Install this if you want help organizing LaTeX papers. Run the asset-generation script only on the intended project root, and expect it to create new .tex files next to image files under assets. If using the suggested IEEE template download, verify the source and inspect the ZIP contents before building or committing them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill instructs the agent to run a local script that generates .tex files under the target project, which is a file-write capability, but it does not declare any corresponding permissions. Undeclared write behavior is risky because users and policy layers cannot accurately constrain or review filesystem modifications, and a compromised or buggy script could overwrite project files unexpectedly.

VirusTotal

64/64 vendors flagged this skill as clean.