The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/compile_latex.py executes the pdflatex system command using subprocess.run. This allows the agent to trigger external binary execution whenever LaTeX compilation is requested.
[DYNAMIC_EXECUTION]: The skill dynamically creates a .tex file from provided content and then processes it through a compiler. This sequence of file generation followed by execution represents a dynamic execution flow that lacks validation of the generated content's safety.
[DYNAMIC_EXECUTION]: The filename parameter in scripts/compile_latex.py is used directly in os.path.join without sanitization. An attacker controlling this argument could use path traversal (e.g., ../../target) to write files outside of the intended temporary directory.
[INDIRECT_PROMPT_INJECTION]: The skill processes LaTeX source code which could be supplied or influenced by external, untrusted sources. LaTeX is a powerful language capable of reading local files (e.g., via \input, \include, or \read) and potentially executing commands if the environment is misconfigured.
Ingestion points: The latex_content argument in scripts/compile_latex.py receives input directly from the agent's context (SKILL.md).
Boundary markers: The skill does not implement any boundary markers or instructions to the agent to ignore potentially malicious embedded LaTeX commands.
Capability inventory: The script has file write permissions, executes pdflatex via subprocess, and returns the resulting file content as base64 data to the agent.
Sanitization: There is no filtering or sanitization of the LaTeX source code to prevent the use of dangerous primitives that access the local filesystem.
[DATA_EXFILTRATION]: By reading sensitive files into the generated document and returning the base64-encoded PDF to the agent, the skill could facilitate the exfiltration of local system information to the user or a third-party service.

latex-pdf-compiler