The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill instructions in references/latex.md direct the agent to use sudo apt install for installing TeX distributions and packages, granting the agent root-level access to the host system.
[DYNAMIC_EXECUTION]: The skill advises enabling the write18 feature in Step 5 of references/latex.md. This LaTeX macro allows the compilation process to execute arbitrary shell commands on the system.
[REMOTE_CODE_EXECUTION]: The skill creates a high-risk scenario by instructing the agent to download templates from external venue websites and compile them with write18 enabled, which allows for the execution of malicious commands embedded in those remote files.
[COMMAND_EXECUTION]: The skill executes multiple shell commands for environment detection (pdflatex, biber, tlmgr), system package management (apt, brew), and LaTeX compilation pipelines.
[EXTERNAL_DOWNLOADS]: The skill downloads venue-specific LaTeX templates from external sources. These sources are not restricted to trusted domains, posing a risk when combined with the skill's execution capabilities.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and analyzes project-specific .tex files without sanitization or boundary markers, creating an attack surface where instructions embedded in these files could influence agent behavior. (1) Ingestion points: references/latex.md (Step 2). (2) Boundary markers: Absent. (3) Capability inventory: sudo access and write18 shell escape. (4) Sanitization: Absent.

paper-write