nature-image2ppt

Warn

Audited by Socket on Sep 14, 2026

1 alert found:

Security
SecurityMEDIUM
cli/image2ppt/runtime/formula_renderer.py

No direct malware/backdoor logic is evident (no network calls, credential access, or obfuscated payloads). However, this module executes a TeX engine on attacker-controlled LaTeX (`tex`/`preamble`) and optionally enables `-shell-escape`, which can permit command execution from within the LaTeX process depending on TeX settings—making it a high-risk capability if inputs are not strictly controlled. Additionally, it runs external document conversion tools on untrusted-rendered content, expanding the attack surface.

Confidence: 78%Severity: 72%
Audit Metadata
Analyzed At
Sep 14, 2026, 04:36 PM
Package URL
pkg:socket/skills-sh/yuan1z0825%2Fnature-skills%2Fnature-image2ppt%2F@3b5bc482a6615c7bd01a26217a37f3524c17dea7a30a099053c35105e494758c
Security Audit — socket — nature-image2ppt