The Agent Skills Directory

[COMMAND_EXECUTION]: The script pr/press_compiler.py executes local LaTeX binaries (pdflatex or xelatex) using subprocess.run(). While the arguments are passed as a list to prevent shell injection, the execution of external compilers introduces risks dependent on the local LaTeX environment configuration, such as the potential for arbitrary command execution if shell-escape is enabled.
[DYNAMIC_EXECUTION]: The skill performs runtime compilation of LaTeX source code into PDF documents. The source code is dynamically generated by the AI agent, incorporating user-provided content.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user requests to generate text for PR documents, which are then passed to the LaTeX compiler. The _escape_latex function in pr/press_compiler.py only escapes a limited set of characters (&, %, #, _), failing to sanitize dangerous LaTeX commands like \input, \include, or \write18. An attacker could use indirect prompt injection to trick the AI into generating LaTeX code that reads sensitive local files or executes system commands during the compilation process.
Ingestion points: User input through the "Nutzerwunsch" trigger in pr/WORKFLOW.md.
Boundary markers: Absent; the skill does not explicitly instruct the model to ignore instructions embedded within the user data when generating LaTeX.
Capability inventory: File system write access (PDF output), local command execution via subprocess.run (pdflatex).
Sanitization: Partial and insufficient; _escape_latex in pr/press_compiler.py ignores many dangerous LaTeX control characters.

textproduction