ClawHub
Back to skill

Security audit

latex-modular

Security checks for vulnerabilities and agentic risk

Overview

This LaTeX skill appears purpose-aligned, but it runs local compilers and can broadly write or delete files without enough scoping or disclosure.

Review before installing. Use this only in a sandboxed or disposable workspace, only with trusted LaTeX sources, and avoid letting an agent pass custom --engine values or arbitrary file paths. Expect it to modify files and run local LaTeX tools despite low-permission metadata.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/validate.py:171
Finding

Untrusted LaTeX Compilation Permits Execution of Lua Primitives

Content
View full analysis
dict: """Compile a .tex file and return the compilation result.""" result = { "success": False, "engine": engine, "tex_path": tex_path, "pdf_path": "", "stdout": "", "stderr": "", "returncode": -1, "log_file": "", "errors": [], "warnings": [], "suggestions": [] } engine_path = find_engine(engine) if not engine_path: result["errors"].append(f"Could not find the {engine} executable") return result work_dir = str(Path(tex_path).parent) tex_filename = Path(tex_path).name try: proc = subprocess.run( [engine_path, "-interaction=nonstopmode", "-halt-on-error", tex_filename], cwd=work_dir, capture_output=True, text=True, timeout=timeout ) result["stdout"] = proc.stdout result["stderr"] = proc.stderr result["returncode"] = proc.returncode pdf_path = Path(tex_path).with_suffix(".pdf") if pdf_path.exists() and pdf_path.stat().st_size > 0: result["success"] = True result["pdf_path"] = str(pdf_path) log_path = Path(tex_path).with_suffix(".log") if log_path.exists(): result["log_file"] = str(log_path) with open(log_path, "r", encoding="utf-8", ...[truncated 3146 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/compose.py:49
Finding

User-Controlled LaTeX Engine Allows Arbitrary Executable Invocation

Content
View full analysis
str: """Find the LaTeX engine path using common locations, the registry, and PATH.""" # Directly accept a supplied full path if os.path.isfile(engine): return engine root = _registry_miktex_root() if root: for sub in [r"miktex\bin\x64", r"miktex\bin"]: p = os.path.join(root, sub, engine) r = _probe_path(p) if r: return r # Additional path probing omitted here only outside the vulnerable branch. try: if sys.platform == "win32": result = subprocess.run(["where", engine], capture_output=True, text=True, timeout=5) else: result = subprocess.run(["which", engine], capture_output=True, text=True, timeout=5) if result.returncode == 0: path = result.stdout.strip().split("\n")[0].strip() if path: return path except Exception: pass return "" ``` ```python # scripts/compose.py:251-302 parser.add_argument( "--engine", default="lualatex", help="LaTeX engine (lualatex/xelatex)" ) args = parser.parse_args() # ... if args.validate: engine_path = find_engine(args.engine) if not engine_path: print(f"[ERROR] Could not find the {args.engine} executable") sys.exit(1) result = subprocess.run( [engine_path, "--interaction=nonstopmode", out_path], capture_output=True, text=True ) ``` ```python # scripts/template.py:304-305 og.add_argument( "--engine", default="lualatex", help="LaTeX engine (lualatex/xelatex)" ) ``` ``` ...[truncated 2300 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/safe_write.py:12
Finding

Agent-Facing Safe-Write Utility Allows Unrestricted File Modification and Deletion

Content
View full analysis
dict: """ Atomically write a file using a temporary file and os.replace(). """ fp = Path(filepath) result = { "success": False, "path": str(fp), "backup": None, "error": None } tmp_fd = None tmp_path = None try: if fp.exists(): backup_dir = fp.parent / ".backup" backup_dir.mkdir(exist_ok=True) backup_name = fp.name + ".bak" backup_path = backup_dir / backup_name shutil.copy2(str(fp), str(backup_path)) result["backup"] = str(backup_path) fp.parent.mkdir(parents=True, exist_ok=True) fd, tmp_path = tempfile.mkstemp( dir=str(fp.parent), suffix=".tmp", prefix=fp.stem + "_" ) tmp_fd = fd with os.fdopen(fd, "w", encoding=encoding, errors="replace") as f: f.write(content) tmp_fd = None os.replace(tmp_path, str(fp)) tmp_path = None result["success"] = True return result ``` ```python # scripts/safe_write.py:121-139 def safe_delete(filepath: str, backup: bool = True) -> dict: """ Delete a file after optionally creating a backup. """ fp = Path(filepath) result = { "success": False, "path": str(fp), "backup": None, "error": None } if not fp.exists(): result["error"] = f"File not found: {filepath}" return result try: if backup: backup_dir = fp.parent / ".backup" backup_dir.mkdir(exist_ok=True) backup_name = ...[truncated 3513 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/template.py:130
Finding

Template Name Path Traversal Allows Writes Outside the Template Directory

Content
View full analysis
str: """Save a template definition to a file.""" td = templates_dir() os.makedirs(td, exist_ok=True) data["name"] = name data["version"] = data.get("version", "1.0.0") data["type"] = "custom" fpath = os.path.join(td, name + ".json") with open(fpath, "w", encoding="utf-8") as f: json.dump(data, f, ensure_ascii=False, indent=2) return fpath ``` ```python # scripts/template.py:320-365 mg = parser.add_argument_group("Template management") mg.add_argument( "--save-as", default="", help="Save the current configuration under a new template name" ) mg.add_argument( "--save-description", default="", help="Description used when saving the template" ) # ... if args.save_as: if template: save_data = dict(template) else: save_data = { "name": args.save_as, "version": "1.0.0", "description": args.save_description or f"Custom template: {args.save_as}", "type": "custom", "styles": {}, "body_template": "", "body_skeleton": BODY_SKELETON.strip(), } save_data["description"] = ( args.save_description or save_data.get("description", "") ) path = save_template(args.save_as, save_data) print(f"[template] Template saved: {path}") template = load_template(args.save_as) ``` ### Technical Analysis The user-controlled `--save-as` value is concatenated with `.json` and joined to the template directory. `os.path.join()` does not prevent traversal. A name containing parent-directory components, such as `../../target`, produces a path outside `scripts/templates`. The code does not require t ...[truncated 1694 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (86)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill documents local LaTeX engine execution, system installation discovery, log parsing, automatic source modification, cleanup of auxiliary files, and JSON output generation. Compiling untrusted LaTeX and auto-editing source files creates a real attack surface because shell execution and file mutation extend beyond passive document handling, and LaTeX toolchains have a history of risky behaviors when processing hostile input.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The skill documents local LaTeX engine execution, system installation discovery, log parsing, automatic source modification, cleanup of auxiliary files, and JSON output generation. Compiling untrusted LaTeX and auto-editing source files creates a real attack surface because shell execution and file mutation extend beyond passive document handling, and LaTeX toolchains have a history of risky behaviors when processing hostile input.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill documents local LaTeX engine execution, system installation discovery, log parsing, automatic source modification, cleanup of auxiliary files, and JSON output generation. Compiling untrusted LaTeX and auto-editing source files creates a real attack surface because shell execution and file mutation extend beyond passive document handling, and LaTeX toolchains have a history of risky behaviors when processing hostile input.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The skill documents local LaTeX engine execution, system installation discovery, log parsing, automatic source modification, cleanup of auxiliary files, and JSON output generation. Compiling untrusted LaTeX and auto-editing source files creates a real attack surface because shell execution and file mutation extend beyond passive document handling, and LaTeX toolchains have a history of risky behaviors when processing hostile input.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill documents local LaTeX engine execution, system installation discovery, log parsing, automatic source modification, cleanup of auxiliary files, and JSON output generation. Compiling untrusted LaTeX and auto-editing source files creates a real attack surface because shell execution and file mutation extend beyond passive document handling, and LaTeX toolchains have a history of risky behaviors when processing hostile input.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The skill documents local LaTeX engine execution, system installation discovery, log parsing, automatic source modification, cleanup of auxiliary files, and JSON output generation. Compiling untrusted LaTeX and auto-editing source files creates a real attack surface because shell execution and file mutation extend beyond passive document handling, and LaTeX toolchains have a history of risky behaviors when processing hostile input.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The skill documents local LaTeX engine execution, system installation discovery, log parsing, automatic source modification, cleanup of auxiliary files, and JSON output generation. Compiling untrusted LaTeX and auto-editing source files creates a real attack surface because shell execution and file mutation extend beyond passive document handling, and LaTeX toolchains have a history of risky behaviors when processing hostile input.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill documents local LaTeX engine execution, system installation discovery, log parsing, automatic source modification, cleanup of auxiliary files, and JSON output generation. Compiling untrusted LaTeX and auto-editing source files creates a real attack surface because shell execution and file mutation extend beyond passive document handling, and LaTeX toolchains have a history of risky behaviors when processing hostile input.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md
| `SKILL.md` frontmatter | Python 原子写入 | `scripts/update_frontmatter.py` |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md
| `SKILL.md` frontmatter | Python 原子写入 | `scripts/update_frontmatter.py` |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md
| `SKILL.md` frontmatter | Python 原子写入 | `scripts/update_frontmatter.py` |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md
- **inject 模式** — 向现有 .tex 增量插入组件，不破坏已有内容。自动将导言区内容追加到目标导言区，正文插入到指定位置。支持 LuaLaTeX/XeLaTeX 直接注入和 pdfLaTeX 语法动态转换（`scripts/component_inject.py`）

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

md
- **inject 模式** — 向现有 .tex 增量插入组件，不破坏已有内容。自动将导言区内容追加到目标导言区，正文插入到指定位置。支持 LuaLaTeX/XeLaTeX 直接注入和 pdfLaTeX 语法动态转换（`scripts/component_inject.py`）

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/antipatterns.md (reported line 18)May include surrounding context.

正确做法：

python
# 使用 safe_write.py 原子写入
python scripts/safe_write.py write SKILL.md "<content>"

或使用 Python 直接调用 safe_write() 函数。

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/refactor.py (reported line 310)May include surrounding context.

python
parser.add_argument("--output-dir", default="scripts/components", help="组件输出目录")
    parser.add_argument("--output-doc", default="", help="输出的模块化主文档路径")
    parser.add_argument("--engine", default="lualatex", help="验证用编译引擎")
    parser.add_argument("--no-validate", action="store_true", help="跳过编译验证")
    parser.add_argument("--keep-body", action="store_true", help="保留 body.tex 文件")
    
    args = parser.parse_args()

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

Allowing the caller to choose the engine binary creates a direct arbitrary-execution primitive on the host. In the context of an agent skill, this is more dangerous because an upstream agent may pass attacker-influenced parameters, causing execution of unexpected local programs under the skill’s privileges.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/changelog.md (reported line 77)May include surrounding context.

md
help="LaTeX 引擎 (lualatex/xelatex)  默认: lualatex")
    og.add_argument("--output-mode", default="tex", choices=["tex", "pdf"],
                    help="输出模式: tex(验证后保留代码) / pdf(保留 .tex+.pdf)  默认: tex")
    og.add_argument("--skip-validation", action="store_true",
                    help="跳过编译验证（快速迭代用）")

    args = parser.parse_args()

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/guide.md (reported line 127)May include surrounding context.

md
help="LaTeX 引擎 (lualatex/xelatex)  默认: lualatex")
    og.add_argument("--output-mode", default="tex", choices=["tex", "pdf"],
                    help="输出模式: tex(验证后保留代码) / pdf(保留 .tex+.pdf)  默认: tex")
    og.add_argument("--skip-validation", action="store_true",
                    help="跳过编译验证（快速迭代用）")

    args = parser.parse_args()

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/template.py (reported line 308)May include surrounding context.

python
help="LaTeX 引擎 (lualatex/xelatex)  默认: lualatex")
    og.add_argument("--output-mode", default="tex", choices=["tex", "pdf"],
                    help="输出模式: tex(验证后保留代码) / pdf(保留 .tex+.pdf)  默认: tex")
    og.add_argument("--skip-validation", action="store_true",
                    help="跳过编译验证（快速迭代用）")

    args = parser.parse_args()

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/template.py (reported line 499)May include surrounding context.

python
help="LaTeX 引擎 (lualatex/xelatex)  默认: lualatex")
    og.add_argument("--output-mode", default="tex", choices=["tex", "pdf"],
                    help="输出模式: tex(验证后保留代码) / pdf(保留 .tex+.pdf)  默认: tex")
    og.add_argument("--skip-validation", action="store_true",
                    help="跳过编译验证（快速迭代用）")

    args = parser.parse_args()

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill declares low sensitivity and omits an explicit tool scope, yet the documentation describes capabilities that read files, write/overwrite files, and invoke system commands such as LaTeX compilation. That mismatch weakens user consent and policy enforcement because an agent may execute materially more powerful actions than the metadata suggests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The markdown describes compiling LaTeX and modifying files without clearly warning that this entails system command execution and filesystem writes. In a skill context, inadequate disclosure is dangerous because users may provide untrusted documents or approve operations without understanding that local commands will run and files may be changed or deleted.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger phrase "模块化模板" is generic and could match ordinary requests about modular templates outside this specific LaTeX skill. The manifest does not provide narrowing context, exclusions, or negative examples to distinguish when this skill should activate versus other template-related tasks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The title and the entire document are written as a Chinese-language handbook, and the guidance later prescribes Chinese-specific formatting conventions. There is no indication that the language requirement is optional, user-selectable, or justified as a region-specific constraint, which can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This markdown file contains user-facing natural-language release notes in Chinese, including section headings and feature descriptions, but does not indicate that the skill is Chinese-only or provide any language/locale opt-in. Under the policy, forcing a specific language without user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.