The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. Untrusted data from inputs.user_message and upstream agent outputs are interpolated into a LaTeX template without sanitization. An attacker can provide inputs containing LaTeX commands to manipulate the document structure or trigger side effects.
[COMMAND_EXECUTION]: The script scripts/compile.py executes system binaries xelatex and bibtex using subprocess.run. While the command-line arguments are fixed, the tools operate on a file whose content is derived from unsanitized user input.
[DATA_EXFILTRATION]: The lack of escaping for LaTeX control sequences allows for potential data exposure. An attacker could inject commands like \input{/etc/passwd} into the template, potentially causing sensitive file contents to be rendered into the output PDF or logs.
[PROMPT_INJECTION]: Mandatory Evidence Chain for Indirect Injection: -- Ingestion points: inputs.user_message, outputs.draft_abstract, and outputs.revised_body in SKILL.md; workspace files like abstract.tex are read in scripts/compile.py. -- Boundary markers: Absent. No delimiters or instructions are provided to the LaTeX engine to treat interpolated text as literal content. -- Capability inventory: subprocess.run calls to xelatex and bibtex in scripts/compile.py. -- Sanitization: Absent. No escaping of LaTeX special characters is performed before interpolation.

latex-compile