The Agent Skills Directory

COMMAND_EXECUTION (SAFE): The scripts/compile.py script executes the typst binary via subprocess.run. It correctly passes arguments as a list and avoids using shell=True, which prevents shell injection vulnerabilities. This is the primary and intended function of the skill.
PROMPT_INJECTION (SAFE): The scripts/parsers.py file contains logic for processing untrusted document content for text analysis. It includes sanitization steps using regex to remove comments, math, and code blocks, which helps mitigate risks associated with indirect prompt injection.
SAFE (SAFE): No findings were detected across all other categories, including data exfiltration, obfuscation, hardcoded credentials, or persistence mechanisms. The skill relies on standard dependencies and follows appropriate design patterns.

typst-paper