sci-ppt
Pass
Audited by Gen Agent Trust Hub on May 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runto call system utilitiespdflatexandpdftoppminsrc/aut_sci_ppt/generator/formula_renderer.pyfor rendering LaTeX formulas into images. It also invokes an external Python script from a companion skill (Sh_Sci_Fig) located in the user's workspace to handle high-DPI figure extraction. - [EXTERNAL_DOWNLOADS]: The skill makes network requests to
latex.codecogs.comto download rendered formula images as a fallback mechanism. It also communicates with official API endpoints for Anthropic, OpenAI, and Moonshot to perform content parsing and academic translation. - [PROMPT_INJECTION]: The skill processes user-provided academic papers and LaTeX code. While this constitutes an indirect prompt injection surface (e.g., potentially malicious LaTeX commands), the risk is mitigated by the fact that
pdflatexis called without the-shell-escapeflag, and the processing is essential to the skill's stated purpose of scientific document generation. - [CREDENTIALS_SAFE]: The skill accesses sensitive API keys (
MOONSHOT_API_KEY,ANTHROPIC_API_KEY,OPENAI_API_KEY) exclusively through environment variables, adhering to secure credential management practices.
Audit Metadata