latex-layout-issue-bundler
Pass
Audited by Gen Agent Trust Hub on May 6, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/create_layout_issue_bundle.pyexecutes system commands usingsubprocess.runwith list-based arguments. This approach is used to invoke utilities likepdftoppm,pdftotext, andImageMagickfor document processing. The use of argument lists instead of raw shell strings prevents command injection vulnerabilities.\n- [SAFE]: No network exfiltration, credential harvesting, or obfuscation was detected. The skill's behavior matches its described purpose of local artifact creation. All external resources used (e.g., ImageMagick, Poppler) are standard system tools expected in the skill's operating environment.\n- [PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection as it ingests content from external files (PDFs, LaTeX source, and logs) and formats them into aprompt.mdintended for other agents. \n - Ingestion points:
scripts/create_layout_issue_bundle.pyreads from PDF files,.texsource files, and compile logs.\n - Boundary markers: The generated
prompt.mduses Markdown headers and code blocks to separate user instructions from ingested snippets.\n - Capability inventory: The skill has the capability to write files to the local repository and execute local command-line tools.\n
- Sanitization: Inputs used for file paths and identifiers are sanitized using a
slugifyfunction to prevent directory traversal.
Audit Metadata