The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The route instructions in routes/latex.md direct the user or agent to execute curl -fsSL https://drop-sh.fullyjustified.net | sh to install the LaTeX engine. This pattern of piping a remote script directly to a shell bypasses all security validation and is a high-risk vector for arbitrary code execution from a source not recognized as a trusted vendor.
[EXTERNAL_DOWNLOADS]: The scripts/pdf.sh script contains a fix command that executes global installations using npm and python3 -m pip without version pinning or source verification. Additionally, scripts/compile_latex.py contains logic to automatically pip install pypdf at runtime if the library is missing.
[COMMAND_EXECUTION]: Several Python scripts, such as scripts/cmd_convert.py and scripts/compile_latex.py, use subprocess.run to call system binaries (soffice and tectonic) with parameters derived from file paths. This pattern can lead to command injection if the inputs are not properly sanitized.
[DYNAMIC_EXECUTION]: The scripts/html_to_pdf.js script utilizes Playwright's page.evaluate to execute JavaScript in a browser context. This is used to render diagrams and formulas from potentially untrusted HTML content provided by the user.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data via HTML and LaTeX files (e.g., input.html in scripts/html_to_pdf.js and main.tex in scripts/compile_latex.py). It lacks boundary markers to separate instructions from data and does not perform sanitization of external content. Combined with its capabilities for file system writes and shell command execution, this creates a surface where embedded malicious instructions could influence agent behavior.

pdf