skills/danielrosehill/claude-programmatic-doc-generation-plugin/batch-render-typst/Gen Agent Trust Hub
batch-render-typst
Warn
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions direct the agent to construct and execute shell commands (e.g.,
typst compile,xargs,parallel) using file paths and basenames derived from a user-controlled data directory. If filenames contain shell metacharacters (e.g., semicolons, backticks) and are not rigorously escaped or sanitized by the implementation, it could lead to arbitrary command execution on the host system when the batch process is triggered. - [PROMPT_INJECTION]: The skill ingests and processes untrusted data from external JSON files and Typst templates, establishing an indirect prompt injection surface.
- Ingestion points: Reads all
*.jsonfiles within a user-specified data directory and an external.typtemplate file (SKILL.md, Approach section). - Boundary markers: The instructions do not specify the use of delimiters or provide "ignore embedded instructions" warnings to the agent when processing these external data files.
- Capability inventory: The skill possesses file system read/write capabilities and the ability to execute subprocesses via the
typstCLI. - Sanitization: There are no instructions for validating the structure or content of the JSON payloads or sanitizing the Typst template before processing.
Audit Metadata