The Agent Skills Directory

[DATA_EXFILTRATION]: The extract_paper_elements.py script contains a path traversal vulnerability in its load_tex function. The script recursively resolves LaTeX \input{} directives by joining paths using os.path.join(base_dir, fname) without validating that the resulting path is within the paper's directory. A malicious LaTeX file could include directives like \input{../../.ssh/id_rsa} to read sensitive files from the local filesystem. The content of these files is then loaded into memory and included in the extraction results, potentially exposing secrets to the agent or saving them into output files.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted LaTeX content and passes it to the agent, creating a potential injection surface. Ingestion points: The extract_paper_elements.py script reads the user-provided .tex file and all files referenced via \input. Boundary markers: Absent. The extracted data is not wrapped in delimiters or safety instructions. Capability inventory: The skill uses a script with arbitrary file read capabilities (due to the path traversal) and the agent is capable of creating and writing files. Sanitization: Absent. The script extracts raw text from the LaTeX source without filtering or sanitizing malicious instructions.

slide-generation