Latex To Nextra Site

• Outcome: Review
• Latest audit: Jul 9, 2026 · 9:19 AM UTC
• Version: 1.1.0

Overview

This skill has a legitimate document-conversion purpose, but it asks agents to run Docker, npm builds, and deployment commands with some consent and command-safety gaps.

Install only if you are comfortable with a skill that may guide your agent to run npm, Docker, git, GitHub, and Vercel workflows. Before allowing execution, confirm each networked or state-changing step, avoid running it on untrusted LaTeX repositories, check diagram filenames for shell metacharacters, and ensure any .npmrc copied into the project contains no private registry token.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The skill declares that host toolchain installation is disabled and should fail closed, but later instructs automatic dependency installation (`npm install`, `npm ci`, and similar setup flows). This creates a policy/behavior mismatch that can cause unintended side effects and package execution on the host despite the stated safety guarantees.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The document says network access is off by default, yet the prescribed build workflow fetches packages from npm registries as a normal step. That contradiction undermines operator expectations and can trigger unapproved external communications and supply-chain exposure.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly orchestrates local Docker and shell-based actions such as rendering diagrams, building the site, and deployment verification. These are real side-effecting operations on the host and go beyond passive document conversion, so an agent following them without a fresh consent gate could modify the system, pull images, consume resources, or expose services.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The file claims host toolchain installation is disabled and should fail closed, but later instructs npm install/ci and Docker-based workflows that inherently fetch dependencies unless separately constrained. This contradiction can mislead a supervising agent into treating later side effects as already authorized, weakening trust and consent boundaries.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The skill states it is offline by default and that all side effects require explicit approval, yet later provides unconditional workflows that perform networked package installation, Docker image pulls, GitHub pushes, and Vercel deployment. This mismatch is security-relevant because it encourages implicit trust in a document that actually normalizes network and execution behavior.

Credential Access

High

• Category: Privilege Escalation

Content

FROM node:18-alpine AS deps
WORKDIR /app
RUN apk add --no-cache libc6-compat
COPY package.json package-lock.json* .npmrc* ./
RUN if [ -f package-lock.json ]; then \
      npm ci --no-audit --no-fund; \
    else \

• Confidence: 84% confidence
• Finding: The Dockerfile copies .npmrc into the build context alongside package manifests. Because .npmrc often contains private registry credentials or auth tokens, this practice can expose secrets to image layers, build logs, or downstream images if users reuse a credentialed file.

Tool Parameter Abuse

Low

• Category: Tool Misuse

Content

try {
    for (const fmt of ["svg", "png"]) {
      const cmd =
        `docker run --rm -v "${srcDir}:/data" -v "${outDir}:/out" ` +
        `plantuml/plantuml:latest -charset UTF-8 -output /out -t${fmt} /data/${file}`;
      execSync(cmd, { stdio: ["ignore", "ignore", "pipe"], windowsHide: true });
    }

• Confidence: 70% confidence
• Finding: The skill constructs a shell command by interpolating host paths and filenames into `docker run ... /data/${file}` and passes it to `execSync`. If file names or paths contain shell-significant characters and are not strictly validated, this can lead to command-injection or unintended parameter manipulation on the host shell.

Tool Parameter Abuse

Low

• Category: Tool Misuse

Content

try {
    for (const fmt of ["svg", "png"]) {
      const cmd =
        `docker run --rm -v "${srcDir}:/data" -v "${outDir}:/out" ` +
        `plantuml/plantuml:latest -charset UTF-8 -output /out -t${fmt} /data/${file}`;
      execSync(cmd, { stdio: ["ignore", "ignore", "pipe"], windowsHide: true });
    }

• Confidence: 78% confidence
• Finding: The script constructs a docker run command by interpolating file and path values into a shell command string passed to execSync. If those values are attacker-controlled or insufficiently validated, this creates command-injection risk or argument-smuggling opportunities, especially on platforms with complex shell quoting behavior.

Static analysis

No suspicious patterns detected.