skills/tjxj/z-skills/poetry-book/Gen Agent Trust Hub

poetry-book

Pass

Audited by Gen Agent Trust Hub on Oct 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill invokes external system commands using subprocess.run to perform its core tasks. Specifically, it calls latexmk for compiling LaTeX documents, gs (Ghostscript) for PDF validation and rendering, and fc-match for system font discovery. These calls are well-defined and scoped to the skill's purpose.
  • [EXTERNAL_DOWNLOADS]: The markdown_article.py script is capable of fetching images from remote HTTPS URLs to embed them in technical articles. The skill includes security checks such as enforcing HTTPS and limiting the maximum file size to 25MB to prevent abuse.
  • [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves processing user-provided content in Markdown or JSON format. To mitigate potential LaTeX injection attacks, the skill uses a TeXCodec class to escape control characters (e.g., \\, {, }, $, %, etc.) before they are written to the LaTeX source file.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 30, 2026, 10:52 AM