latex-thesis-zh
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/compile.pyutilizessubprocess.runto execute standard LaTeX compilers such asxelatex,lualatex, andlatexmk. The skill includes a significant safety feature that prevents the use of the potentially dangerous--shell-escapeflag unless the user explicitly provides a--trusted-sourceconfirmation. - [COMMAND_EXECUTION]: The
scripts/check_format.pyscript attempts to run thechktexutility to perform syntax checking if it is installed on the local system. - [EXTERNAL_DOWNLOADS]: The
scripts/online_bib_verify.pycomponent performs network GET requests to well-known scholarly databases, specificallyapi.crossref.organdapi.semanticscholar.org, to verify bibliography entries. This functionality is restricted to scholarly metadata retrieval and is intended to be used only with user authorization. - [INDIRECT_PROMPT_INJECTION]: The skill documentation includes a robust security boundary that instructs the agent to treat all user-provided
.texand.bibfiles as untrusted data. It explicitly commands the agent to ignore any instructions embedded in those files that attempt to reveal prompts, read sensitive files, or override the skill's defined workflow.
Audit Metadata