ClawHub
Back to skill

Security audit

latex-modular

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real LaTeX document skill, but it should be reviewed because it can modify local files and run a LaTeX compiler while declaring low permissions.

Install only if you are comfortable with a skill that edits local LaTeX/project files and runs your system LaTeX compiler. Use it in a dedicated workspace, verify output paths before running write/delete/refactor/inject modes, and avoid compiling untrusted .tex files on your main machine unless the compiler is sandboxed and automatic package installation/shell escape are disabled.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (26)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
print(f"  安装 TeX Live：https://tug.org/texlive/")
            print(f"  或将 {args.engine} 所在目录加入系统 PATH 环境变量")
            sys.exit(1)
        result = subprocess.run(
            [engine_path, "--interaction=nonstopmode", out_path],
            capture_output=True, text=True
        )
Confidence
96% confidence
Finding
When --validate is used, the script executes a user-selected LaTeX engine on a generated .tex file assembled from manifest-controlled component files. LaTeX engines are powerful interpreters that can read/write files and, depending on configuration and TeX features, may enable command execution or unsafe file access, so compiling untrusted content is a real code-execution/trust-boundary risk.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def validate_tex(tex_path: str, engine: str = "lualatex") -> dict:
    try:
        proc = subprocess.run(
            [engine, "-interaction=nonstopmode", "-halt-on-error", tex_path],
            capture_output=True, text=True, timeout=120
        )
Confidence
96% confidence
Finding
The code executes a user-controlled external binary via the --engine parameter and feeds it a generated TeX file that can contain attacker-supplied LaTeX from --content. In a skill that processes untrusted document content, invoking LaTeX engines can enable arbitrary file reads, command execution via TeX features or engine flags, and resource-exhaustion attacks depending on engine configuration.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
tex_filename = Path(tex_path).name
    
    try:
        proc = subprocess.run(
            [engine_path, "-interaction=nonstopmode", "-halt-on-error", tex_filename],
            cwd=work_dir,
            capture_output=True,
Confidence
95% confidence
Finding
The script compiles an arbitrary user-supplied .tex file by invoking a LaTeX engine. Even though subprocess.run is used without a shell, LaTeX itself is a powerful interpreter and compiling untrusted TeX can lead to arbitrary file reads, filesystem writes, resource exhaustion, and in some configurations command execution via TeX escape features or dangerous primitives. In the context of an agent skill, this substantially increases risk because the tool is explicitly designed to process attacker-controlled document content.

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill declares low sensitivity and no meaningful permissions while explicitly describing capabilities for file read/write and shell-like subprocess execution via LaTeX compilation. This is dangerous because downstream policy and reviewers may under-trust the operational risk, allowing a skill that can modify files and invoke external tools to run without appropriate consent, sandboxing, or permission prompts.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding
The documented behavior substantially exceeds the stated purpose: beyond modular LaTeX composition, it performs template management, component injection, conversion, state persistence, frontmatter mutation, deletion helpers, and compiler execution. Such scope creep is dangerous because users and security controls may authorize the skill for a narrow document task while it actually has broader code execution and filesystem modification reach.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The skill's advertised purpose is modular LaTeX composition, but this code adds an external compilation capability that materially increases risk because it executes a LaTeX engine over assembled content. In this context, the danger is elevated because the manifest and component files can carry attacker-controlled TeX directives, turning validation into execution of untrusted document code.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The utility accepts arbitrary file paths and exposes write, patch, insert, regex-replace, and delete operations without any scope restriction to a designated LaTeX workspace or approved extensions. In an agent setting, if untrusted input can influence the path, this becomes a general-purpose file modification primitive that can overwrite or remove unrelated project files, configuration, or other sensitive local data.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The command-line interface exposes a delete command for arbitrary paths, which exceeds the stated purpose of modular LaTeX document assembly and increases the blast radius of misuse. Even with backup behavior, deletion is destructive and can be abused by a calling agent or crafted inputs to remove unrelated files within the agent's accessible filesystem.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
This script goes beyond simple templating and actively executes compose.py and a LaTeX compiler on generated content. In the context of a skill that accepts custom LaTeX body content, execution of external programs materially increases the attack surface and turns untrusted input into code-like input for complex parsers.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill advertises saving components and generating or rewriting files, but it does not prominently warn users that local files will be created or modified. This can lead to unintended overwrites, repository changes, or persistence of untrusted LaTeX-derived content, especially when operating on existing projects.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
Validation mode invokes the system LaTeX engine, which is subprocess execution on user-supplied document content and may trigger additional environment effects such as file generation, package loading, and engine-specific behaviors. Without an explicit warning and execution constraints, users may not realize they are authorizing local command execution on potentially unsafe LaTeX input.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The note that MiKTeX may automatically install missing packages introduces implicit network access and third-party code/package retrieval during compilation, but this is not framed as a security warning. This is dangerous because compiling an untrusted document could unexpectedly change the local environment and fetch external packages without deliberate user approval.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger phrase "模块化模板" is broad enough to match unrelated user requests about modular templates, not specifically this LaTeX skill. That can cause accidental invocation of the skill in the wrong context, leading the agent to apply file-generation or transformation behavior the user did not intend.

Unvalidated Output Injection

High
Category
Output Handling
Content
# 4. PATH / where 命令
    try:
        if sys.platform == "win32":
            result = subprocess.run(["where", engine], capture_output=True, text=True, timeout=5)
        else:
            result = subprocess.run(["which", engine], capture_output=True, text=True, timeout=5)
        if result.returncode == 0:
Confidence
95% confidence
Finding
Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Unvalidated Output Injection

High
Category
Output Handling
Content
if sys.platform == "win32":
            result = subprocess.run(["where", engine], capture_output=True, text=True, timeout=5)
        else:
            result = subprocess.run(["which", engine], capture_output=True, text=True, timeout=5)
        if result.returncode == 0:
            path = result.stdout.strip().split("\n")[0].strip()
            if path:
Confidence
95% confidence
Finding
Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Unvalidated Output Injection

High
Category
Output Handling
Content
print(f"  安装 TeX Live：https://tug.org/texlive/")
            print(f"  或将 {args.engine} 所在目录加入系统 PATH 环境变量")
            sys.exit(1)
        result = subprocess.run(
            [engine_path, "--interaction=nonstopmode", out_path],
            capture_output=True, text=True
        )
Confidence
93% confidence
Finding
The subprocess itself is invoked safely with an argv list, but it executes an engine path that may come from PATH/where/which resolution and then processes untrusted LaTeX content. In practice the danger here is execution of a potentially attacker-controlled binary and/or unsafe interpretation of attacker-controlled TeX, so this line participates in a real execution sink even if the label 'output injection' is imprecise.

Unvalidated Output Injection

High
Category
Output Handling
Content
if author:
        cmd.extend(["--author", author])
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
        return {
            "success": result.returncode == 0,
            "stdout": result.stdout,
Confidence
95% confidence
Finding
Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Unvalidated Output Injection

High
Category
Output Handling
Content
def validate_tex(tex_path: str, engine: str = "lualatex") -> dict:
    try:
        proc = subprocess.run(
            [engine, "-interaction=nonstopmode", "-halt-on-error", tex_path],
            capture_output=True, text=True, timeout=120
        )
Confidence
95% confidence
Finding
Compiling attacker-influenced TeX is effectively processing a powerful macro language with an external binary, and the engine name is also user-controllable. In this context, untrusted content can trigger dangerous file access, shell-escape-related behavior, or denial of service, making this a real output/execution injection risk for the host environment.

Unvalidated Output Injection

High
Category
Output Handling
Content
# 4. PATH / where 命令
    try:
        if sys.platform == "win32":
            result = subprocess.run(["where", engine], capture_output=True, text=True, timeout=5)
        else:
            result = subprocess.run(["which", engine], capture_output=True, text=True, timeout=5)
        if result.returncode == 0:
Confidence
95% confidence
Finding
Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Unvalidated Output Injection

High
Category
Output Handling
Content
if sys.platform == "win32":
            result = subprocess.run(["where", engine], capture_output=True, text=True, timeout=5)
        else:
            result = subprocess.run(["which", engine], capture_output=True, text=True, timeout=5)
        if result.returncode == 0:
            path = result.stdout.strip().split("\n")[0].strip()
            if path:
Confidence
95% confidence
Finding
Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Unvalidated Output Injection

High
Category
Output Handling
Content
tex_filename = Path(tex_path).name
    
    try:
        proc = subprocess.run(
            [engine_path, "-interaction=nonstopmode", "-halt-on-error", tex_filename],
            cwd=work_dir,
            capture_output=True,
Confidence
93% confidence
Finding
Compiling attacker-controlled TeX content creates a dangerous interpreter boundary: the LaTeX engine processes complex directives from the document and may read local files, generate arbitrary auxiliary outputs, or trigger command execution depending on engine configuration. The risk is amplified here because the tool is specifically intended to validate and optionally modify untrusted LaTeX documents, making hostile input realistic.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
- 展示所有组件的使用方法（mylist、timu、seeref 等）
  - 支持 `--no-sample` 只输出骨架
  - 支持 `--output-mode tex|pdf` 选择输出形式
  - 支持 `--skip-validation` 跳过编译验证
  - 验证为默认核心步骤（不再是可选项）

### 修复
Confidence
21% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
| `--output` / `-o` | template_output.tex | 输出的 .tex 文件路径 |
| `--engine` | lualatex | LaTeX 引擎：lualatex / xelatex |
| `--output-mode` | tex | 输出模式：tex(保留已验证代码) / pdf(保留 .tex+.pdf) |
| `--skip-validation` | (默认验证) | 跳过编译验证（快速迭代用） |
| `--no-sample` | (生成示例) | 只输出骨架，不生成示例正文 |

**生成内容**：
Confidence
21% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
parser.add_argument("--output-dir", default="scripts/components", help="组件输出目录")
    parser.add_argument("--output-doc", default="", help="输出的模块化主文档路径")
    parser.add_argument("--engine", default="lualatex", help="验证用编译引擎")
    parser.add_argument("--no-validate", action="store_true", help="跳过编译验证")
    parser.add_argument("--keep-body", action="store_true", help="保留 body.tex 文件")
    
    args = parser.parse_args()
Confidence
85% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
help="LaTeX 引擎 (lualatex/xelatex)  默认: lualatex")
    og.add_argument("--output-mode", default="tex", choices=["tex", "pdf"],
                    help="输出模式: tex(验证后保留代码) / pdf(保留 .tex+.pdf)  默认: tex")
    og.add_argument("--skip-validation", action="store_true",
                    help="跳过编译验证（快速迭代用）")

    args = parser.parse_args()
Confidence
80% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Static analysis

No suspicious patterns detected.