latex-posters

Pass

Audited by Gen Agent Trust Hub on Nov 6, 2026

Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
  • [PROMPT_INJECTION]: The SKILL.md file contains highly assertive markers (e.g., "⚠️ MANDATORY", "This is not optional") and specific imperatives to dictate the agent's behavior and force a specific multi-skill workflow. It also attempts to inject an external persona ("Nano Banana Pro") into the agent's operational context to handle schematic generation.
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands that incorporate unvalidated user input directly into command-line arguments: python scripts/generate_schematic.py "your diagram description". This pattern is vulnerable to command injection if a user provides a description containing shell metacharacters.
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions for the agent to download and install external LaTeX packages (such as beamerposter, tikzposter, and baposter) from remote repositories using the tlmgr package manager.
  • [REMOTE_CODE_EXECUTION]: The documentation references multiple automation scripts (including compile_poster.sh, generate_template.py, resize_images.py, and poster_checklist.py) as being available in the scripts/ directory; however, these files are missing from the skill distribution, making them unverifiable and potentially unsafe dependencies.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 6, 2026, 12:15 PM