latex-posters
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The
SKILL.mdfile contains highly assertive markers (e.g., "⚠️ MANDATORY", "This is not optional") and specific imperatives to dictate the agent's behavior and force a specific multi-skill workflow. It also attempts to inject an external persona ("Nano Banana Pro") into the agent's operational context to handle schematic generation. - [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands that incorporate unvalidated user input directly into command-line arguments:
python scripts/generate_schematic.py "your diagram description". This pattern is vulnerable to command injection if a user provides a description containing shell metacharacters. - [EXTERNAL_DOWNLOADS]: The skill provides instructions for the agent to download and install external LaTeX packages (such as
beamerposter,tikzposter, andbaposter) from remote repositories using thetlmgrpackage manager. - [REMOTE_CODE_EXECUTION]: The documentation references multiple automation scripts (including
compile_poster.sh,generate_template.py,resize_images.py, andposter_checklist.py) as being available in thescripts/directory; however, these files are missing from the skill distribution, making them unverifiable and potentially unsafe dependencies.
Audit Metadata