paper-compile
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
Bash(*)to execute LaTeX compilation tools (latexmk,pdflatex), file system checks (ls,grep), and utility tools (pdftotext,pdfinfo). This access is necessary for the stated purpose of compiling and verifying paper artifacts. - [DYNAMIC_EXECUTION]: In Step 6, the skill utilizes a Python one-liner (
python3 -c "...") to process output frompdftotext. This is a standard method for data parsing and the embedded script is restricted to basic string manipulation of the PDF content for page counting. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-controlled LaTeX source files (
.texand.bib). While this represents an ingestion surface for untrusted data, the skill does not use high-risk LaTeX flags such as--shell-escapeduring compilation, which significantly reduces the risk of malicious files executing arbitrary code during the build process. - [REMOTE_CODE_EXECUTION]: The skill documentation includes instructional comments for environment setup (e.g.,
brew install,apt-get install,conda install). These are presented as guidance for the user if tools are missing and are not configured for automatic execution by the agent, maintaining user oversight.
Audit Metadata