The Agent Skills Directory

Privilege Escalation (HIGH): The SKILL.md file explicitly instructs the agent or user to execute sudo apt install texlive-full for troubleshooting. Directing the use of sudo is a high-risk pattern that can lead to unauthorized system modification.
Remote Code Execution (HIGH): The skill runs pdflatex on the input .tex file. LaTeX is an inherently powerful language that, by default, often allows 'shell escape' (executing system commands) or reading/writing arbitrary files on the system. The script does not include the -no-shell-escape flag or other sandboxing measures to mitigate the risk of malicious .tex files.
Command Execution (MEDIUM): The compile_paper.py script uses subprocess.run to execute multiple external binaries (pdflatex, bibtex, chktex). While it uses a list for command arguments to prevent simple shell injection, the execution of these binaries on untrusted input remains a security concern.
Indirect Prompt Injection (LOW): The skill processes untrusted .tex data through an 'Auto-fix' loop in Step 3. An attacker could craft a LaTeX file that produces specific error messages in the logs, which are then parsed by the agent to trigger unintended file modifications or command parameters during the fix_latex_errors.py phase.
Ingestion points: paper/main.tex and the resulting compile.log.
Boundary markers: None present; the agent treats log errors as trusted instructions for correction.
Capability inventory: File read/write via compile_paper.py and fix_latex_errors.py; execution of system binaries via subprocess.run.
Sanitization: None; the script extracts raw error lines and displays them to the agent for processing.

paper-compilation