typst

Pass

Audited by Gen Agent Trust Hub on Jun 13, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/compile.py acts as a wrapper for the Typst CLI. It uses subprocess.run() with a list of arguments and shell=False (default), which is the recommended secure method for executing external processes as it prevents shell injection vulnerabilities.
  • [SAFE]: The skill references official Typst documentation and domains (typst.app). These are well-known resources relevant to the skill's primary purpose and do not represent a security risk.
  • [SAFE]: The instructions and configuration files are focused on document formatting and compilation workflows. No evidence of prompt injection, data exfiltration, or obfuscation was detected across the provided files.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 13, 2026, 01:27 AM
Security Audit — agent-trust-hub — typst