T09 · Insecure Skill Coding Practices
- Location
SKILL.md:183- Finding
Unsafe LaTeX Shell Escape Enables Arbitrary Command Execution
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:183
Vulnerability Type: Unsafe PDF engine configuration
Risk Level: HighVulnerable Code
bash pandoc --pdf-engine=xelatex --pdf-engine-opt=-shell-escape input.md -o output.pdfTechnical Analysis
The documented command passes
-shell-escapeto XeLaTeX. This option allows TeX processing to invoke operating-system commands. Shell escape is not normally required for document conversion and substantially weakens the isolation boundary between document content and the host operating system.If an AI agent follows this example while converting attacker-controlled Markdown, LaTeX, templates, metadata, or included resources, malicious TeX primitives or packages can execute local commands with the privileges of the Pandoc process. The example does not warn users that the option should only be used with trusted input or inside a hardened sandbox.
The project’s wrapper does not enable shell escape automatically; the vulnerability is confined to the unsafe command recommended in the Skill documentation.
Attack Path
- An attacker supplies a crafted document or included resource containing malicious LaTeX content.
- The user or agent requests PDF conversion and applies the documented
-shell-escapeexample. - Pandoc generates or processes LaTeX and invokes XeLaTeX with shell command execution enabled.
- The attacker-controlled TeX content invokes an operating-system command.
- The command executes under the account running Pandoc and can access resources available to that account.
Impact Assessment
Successful exploitation can provide arbitrary command execution with the privileges of the converting user. Depending on the execution environment, an attacker could:
- Read accessible files, environment variables, tokens, and credentials.
- Create, overwrite, or delete files.
- Execute installed programs or scripts.
- Make network requests if outbound connectivity is available.
...[truncated 198 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the
-shell-escapeexample and keep LaTeX shell escape disabled by default. - If a conversion explicitly requires shell escape, permit it only for fully trusted documents, templates, filters, and resources.
- Require explicit user approval before enabling the option; never infer or add it automatically.
- Perform unavoidable shell-escape conversions in an ephemeral, unprivileged container or sandbox.
- Remove secrets from the environment, disable outbound network access, use a read-only root filesystem, and expose only narrowly scoped input and output directories.
- Apply CPU, memory, process, and execution-time limits.
- Validate and constrain included files, LaTeX packages, templates, and resource paths.
- Add a prominent warning explaining that
-shell-escapecan turn crafted document input into local command execution.
- Remove the