nature-image2ppt

Warn

Audited by Socket on Aug 23, 2026

1 alert found:

Security
SecurityMEDIUM
cli/image2ppt/runtime/formula_renderer.py

No direct malware/backdoor logic is evident (no network calls, credential access, or obfuscated payloads). However, this module executes a TeX engine on attacker-controlled LaTeX (`tex`/`preamble`) and optionally enables `-shell-escape`, which can permit command execution from within the LaTeX process depending on TeX settings—making it a high-risk capability if inputs are not strictly controlled. Additionally, it runs external document conversion tools on untrusted-rendered content, expanding the attack surface.

Confidence: 78%Severity: 72%
Audit Metadata
Analyzed At
Aug 23, 2026, 12:06 PM
Package URL
pkg:socket/skills-sh/yuan1z0825%2Fnature-skills%2Fnature-image2ppt%2F@f2180723ba398369537b142381b0abbd204cd7be86f2d8656c1c3b5ff8f8df83
Security Audit — socket — nature-image2ppt