The Agent Skills Directory

[COMMAND_EXECUTION]: The skill directly interpolates the $ARGUMENTS variable into several shell commands, including 'ls Slides/$ARGUMENTS*.tex', 'cd Figures/$ARGUMENTS', and './scripts/sync_to_docs.sh $ARGUMENTS'. This pattern is highly susceptible to shell command injection if the input provided via $ARGUMENTS is not strictly validated or sanitized by the platform.
[DYNAMIC_EXECUTION]: The skill uses xelatex to compile a .tex file that is dynamically generated or updated from external Beamer source files. Compiling LaTeX is a form of dynamic execution, as the LaTeX engine is capable of performing complex operations, including file system access, which could be exploited if the source content is malicious.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted content from external Beamer files without sufficient security boundaries or sanitization. The mandatory evidence chain is as follows:
Ingestion points: The skill reads Beamer source files using Glob and Read tools (Slides/$ARGUMENTS*.tex).
Boundary markers: No specific delimiters or safety instructions are used when passing the extracted TikZ content to the agent or subagent.
Capability inventory: The skill possesses significant capabilities, including arbitrary shell command execution (Bash) and the ability to spawn subagents (Agent).
Sanitization: The check-tikz-prevention.py script validates TikZ syntax and best practices (e.g., node scaling) but does not perform security-related sanitization or instruction filtering of the LaTeX content.

extract-tikz