awesome-phd-cv
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PRIVILEGE_ESCALATION]: The setup guide includes commands to install system-wide TeX distributions and font packages using
sudo apt-get install, which requires elevated permissions on Linux environments. - [EXTERNAL_DOWNLOADS]: The skill references and fetches external content by cloning a LaTeX template repository from GitHub (
https://github.com/LimHyungTae/Awesome-PhD-CV.git). - [COMMAND_EXECUTION]: The skill provides various shell commands for environment configuration, repository management, and LaTeX document compilation using
pdflatexandxelatexengines. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process user-supplied professional details and interpolate them into LaTeX templates, creating a surface for indirect prompt injection if the inputs contain malicious LaTeX commands.
- Ingestion points: User-provided resume data interpolated into
resume.tex,cv.tex, and section files withincv/(e.g.,education.tex,publications.tex). - Boundary markers: No specific delimiters or safety instructions are provided to the agent to ignore or sanitize embedded commands within the user data.
- Capability inventory: The skill utilizes shell-based build tools (
pdflatex,xelatex) and file management commands (rm,cd). - Sanitization: There is no evidence of sanitization, escaping, or validation performed on user-provided strings before they are inserted into the LaTeX source files.
Audit Metadata