The Agent Skills Directory

[COMMAND_EXECUTION]: The script is vulnerable to path traversal through the --outputs command-line argument. When constructing the paths for the PDF and build report, it joins the workspace directory with the user-provided output paths using pathlib.Path. If an absolute path is provided in the --outputs argument, the resulting path will resolve to that absolute location, potentially allowing the skill to overwrite files outside of the designated workspace.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted LaTeX source code and includes compiler output in a report, which constitutes an indirect prompt injection surface.
Ingestion points: The script reads the LaTeX source file (latex/slides/main.tex) indirectly via the compiler and directly reads the compilation logs and standard output/error streams in scripts/run.py.
Boundary markers: The generated output/SLIDES_BUILD_REPORT.md uses markdown sections but lacks explicit delimiters or instructions to prevent downstream agents from interpreting content within the logs as commands.
Capability inventory: The skill can execute shell commands via subprocess.run (for latexmk, xelatex, and pdfinfo) and perform file system write operations using shutil.copy2 and atomic_write_text.
Sanitization: There is no evidence of sanitization or escaping of the compiler's stdout, stderr, or log file content before it is embedded in the markdown report.
[DYNAMIC_EXECUTION]: The script dynamically invokes system binaries (latexmk, xelatex, pdfinfo) using subprocess.run. While it avoids shell=True, it operates on files within a workspace that may contain attacker-controlled content.

beamer-compile-qa