paper-compile

Pass

Audited by Gen Agent Trust Hub on Jul 18, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses Bash(*) to execute LaTeX compilation tools (latexmk, pdflatex), file system checks (ls, grep), and utility tools (pdftotext, pdfinfo). This access is necessary for the stated purpose of compiling and verifying paper artifacts.
  • [DYNAMIC_EXECUTION]: In Step 6, the skill utilizes a Python one-liner (python3 -c "...") to process output from pdftotext. This is a standard method for data parsing and the embedded script is restricted to basic string manipulation of the PDF content for page counting.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-controlled LaTeX source files (.tex and .bib). While this represents an ingestion surface for untrusted data, the skill does not use high-risk LaTeX flags such as --shell-escape during compilation, which significantly reduces the risk of malicious files executing arbitrary code during the build process.
  • [REMOTE_CODE_EXECUTION]: The skill documentation includes instructional comments for environment setup (e.g., brew install, apt-get install, conda install). These are presented as guidance for the user if tools are missing and are not configured for automatic execution by the agent, maintaining user oversight.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 18, 2026, 04:51 PM
Security Audit — agent-trust-hub — paper-compile