transfer-old-latex-to-new

No clear malware, credential theft, network exfiltration, persistence, or destructive behavior is present. The code is a LaTeX build runner, but it executes commands selected by configuration and processes potentially active LaTeX input. It should not be used with untrusted configuration or projects without executable allowlisting, path validation, environment minimization, and a sandboxed TeX environment. The code is readable and not materially obfuscated.

The code is a benign-looking LaTeX project analyzer with a path traversal and robustness weakness. Included-file paths are resolved and read without verifying that they remain inside project_root, which can permit unintended local file reads and can trigger a denial of service when relative_to fails. No evidence of malware, exfiltration, credential theft, persistence, or command execution is present in this fragment.

The code is a straightforward run-directory management module with no apparent malicious behavior. However, caller-controlled run_id values can escape runs_root through path traversal or symlinks because resolve() is not followed by a containment check. In create_run(), this can create multiple directories outside the intended root. Validate run_id as a safe path component or verify that the resolved root is contained within runs_root before filesystem operations. The exists-then-mkdir uniqueness logic also has a race condition.