Agent skill · Audited from source

latex-document

skill · ndpvt-web/latex-document-skillLicence not declaredAudited 20 Oct 2026 · source f9606116daba

★ 791pushed today
✕BLOCKGrade F · 59/100 · 20 findings · f960611
791repo stars · whole ndpvt-web/latex-document-skill

Is it safe? No — BLOCK, grade F (59/100). We read this skill's source at commit f9606116daba and observed network and shell access and no hard-coded secrets. The audit raised 20 findings, 6 critical or high. What it does: Universal LaTeX document skill: create, compile, and convert any document to professional PDF with PNG previews. Supports resumes, reports, cover letters, invoices, academic papers, theses/dissertations, academic CVs,…

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “latex-document (ndpvt-web/latex-document-skill)”. Retrieved 20 Oct 2026. https://modelsatlas.com/skills/ndpvt-web/latex-document

Blocked. The page stays public so you can check this skill if someone recommended it to you. The audit found 6 critical or high findings, starting with “Privilege escalation / persistence” in scripts/compile_latex.sh:281. Do not install it without reading them.

Trust audit

Audit 0.4.1 · source read 20 Oct 2026

Trust score59/100✕BLOCK F
0 critical6 high5 medium3 low6 info

BLOCK means the audit found something that could harm you or your machine. Grade F is shared by 105 of 14,816 audited skills.

What the source does

  • FilesystemNone observedNo reads or writes in the source
  • NetworkDeclared5 observations
  • ShellDeclared5 observations
  • DependenciesNot pinnedSome versions float
  • SecretsNone foundNo keys in source

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityPASS7
L1 Static sourceSecrets, path traversal, supply chain, hidden codeFAIL11
L2 InstructionsPrompt injection, authority framing, hidden directivesFAIL2
L3 InventoryThe files and declarations match the sourcePASS0
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: no behavioural pass, no license.

Findings (20)

HIGHPrivilege escalation / persistencepriv.escalate · scripts/compile_latex.sh:281
F-06 Privilege escalation / persistenceCWE-269 · CWE-250Layer L1
echo "    → Install with: sudo apt-get install texlive-latex-extra" >&2
Why
asks for elevated privileges
Fix
—
HIGHPrivilege escalation / persistencepriv.escalate · scripts/compile_latex.sh:577
F-06 Privilege escalation / persistenceCWE-269 · CWE-250Layer L1
echo "Error: latexmk not found. Install with: sudo apt-get install latexmk" >&2
Why
asks for elevated privileges
Fix
—
HIGHPrivilege escalation / persistencepriv.escalate · scripts/convert_document.sh:89
F-06 Privilege escalation / persistenceCWE-269 · CWE-250Layer L1
error "  Ubuntu/Debian:  sudo apt-get install pandoc"
Why
asks for elevated privileges
Fix
—
HIGHPrivilege escalation / persistencepriv.escalate · scripts/convert_document.sh:91
F-06 Privilege escalation / persistenceCWE-269 · CWE-250Layer L1
error "  Fedora/RHEL:    sudo dnf install pandoc"
Why
asks for elevated privileges
Fix
—
HIGHPrivilege escalation / persistencepriv.escalate · scripts/convert_document.sh:92
F-06 Privilege escalation / persistenceCWE-269 · CWE-250Layer L1
error "  Alpine:         sudo apk add pandoc"
Why
asks for elevated privileges
Fix
—
HIGHPrompt injectionprompt.tool_poisoning · references/script-tools.md:21
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
**IMPORTANT: ALWAYS use the AskUserQuestion tool to ask the user what password they want BEFORE encrypting any PDF. NEVER use a default or auto-generated password. The user must explicitly choose thei
Why
a tool description carrying instructions to the agent
Fix
tool descriptions describe the tool; nothing else
MEDIUMCode injectioncode.dynamic_import · scripts/csv_to_latex.py:31
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
__import__(import_name)
Why
No further detail recorded for this rule.
Fix
—
MEDIUMCode injectioncode.dynamic_import · scripts/generate_chart.py:32
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
__import__(import_name)
Why
No further detail recorded for this rule.
Fix
—
MEDIUMCode injectioncode.dynamic_import · scripts/pdf_check_form.py:23
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
__import__(import_name)
Why
No further detail recorded for this rule.
Fix
—
MEDIUMCode injectioncode.dynamic_import · scripts/pdf_extract_fields.py:23
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
__import__(import_name)
Why
No further detail recorded for this rule.
Fix
—
MEDIUMCode injectioncode.dynamic_import · scripts/pdf_fill_annotations.py:23
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
__import__(import_name)
Why
No further detail recorded for this rule.
Fix
—
LOWInventory / provenanceinv.hidden_file · .chktexrc
F-13 Inventory / provenanceCWE-1104Layer L0
.chktexrc
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWInventory / provenanceinv.no_license
F-13 Inventory / provenanceCWE-1104Layer L0
Why
no LICENSE file and no repo licence
Fix
add a licence
LOWSupply chainsupply.unpinned · requirements.txt
F-08 Supply chainCWE-829 · CWE-1357Layer L1
matplotlib, numpy, pandas, jinja2
Why
4 requirement(s) not pinned with ==
Fix
pin exact versions
INFOInventory / provenanceinv.oversize · assets/capy-printer.png
F-13 Inventory / provenanceCWE-1104Layer L0
assets/capy-printer.png
Why
2342976 bytes not read
Fix
—
INFOInventory / provenanceinv.oversize · assets/capy-professor.png
F-13 Inventory / provenanceCWE-1104Layer L0
assets/capy-professor.png
Why
1755595 bytes not read
Fix
—
INFOInventory / provenanceinv.oversize · assets/capy-wizard.png
F-13 Inventory / provenanceCWE-1104Layer L0
assets/capy-wizard.png
Why
1929778 bytes not read
Fix
—
INFOInventory / provenanceinv.oversize · examples/cheatsheet-p1.png
F-13 Inventory / provenanceCWE-1104Layer L0
examples/cheatsheet-p1.png
Why
1674983 bytes not read
Fix
—
INFOInventory / provenanceinv.oversize · examples/cheatsheet-p2.png
F-13 Inventory / provenanceCWE-1104Layer L0
examples/cheatsheet-p2.png
Why
1327616 bytes not read
Fix
—
INFOPrompt injectionscope.undeclared_system · <declared scope>
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
system use found in code, not declared in the description
Why
the description does not admit a capability the code has
Fix
declare system use in the description, or remove it

Audit 0.4.1 · source sha f9606116daba · 20 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • Publisherndpvt-web GitHub userOwner of the repository this skill is read from
  • Source folderndpvt-web/latex-document-skillThe exact folder we audited
  • LicenceNot declaredAs the repository states it
  • Commit pinned for this verdictf9606116dabaA new audit runs when the source changes
  • Repository statusNot archivedPushed today
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: Universal LaTeX document skill: create, compile, and convert any document to professional PDF with PNG previews. Supports resumes, reports, cover letters, invoices, academic papers, theses/dissertations, academic CVs,…

---
name: latex-document-skill
description: >
  Universal LaTeX document skill: create, compile, and convert any document to
  professional PDF with PNG previews. Supports resumes, reports, cover letters,
  invoices, academic papers, theses/dissertations, academic CVs, presentations
  (Beamer), scientific posters, formal letters, exams/quizzes, books,
  cheat sheets, reference cards, exam formula sheets,
  fillable PDF forms (hyperref form fields), conditional content (etoolbox toggles),
  mail merge from CSV/JSON (Jinja2 templates), version diffing (latexdiff),
  charts (pgfplots + matplotlib), tables (booktabs + CSV import), images (TikZ),
  Mermaid diagrams, AI-generated images, watermarks, landscape pages,
  bibliography/citations (BibTeX/biblatex), multi-language/CJK (auto XeLaTeX),
  algorithms/pseudocode, colored boxes (tcolorbox), SI units (siunitx),
  Pandoc format conversion (Markdown/DOCX/HTML ↔ LaTeX),
  and PDF-to-LaTeX conversion of handwritten or printed documents (math, business,
  legal, general). Compile script supports pdflatex, xelatex, lualatex with
  auto-detection, latexmk backend, texfot log filtering, PDF/A output, and
  verbosity control (--verbose/--quiet). Empirically optimized scaling: single agent 1-10 pages, split
  11-20, batch-7 pipeline 21+. Use when user asks to: (1) create a resume/CV/cover
  letter, (2) write a LaTeX document, (3) create PDF with tables/charts/images,
  (4) compile a .tex file, (5) make a report/invoice/presentation, (6) anything
  involving LaTeX or pdflatex, (7) convert/OCR a PDF to LaTeX, (8) convert
  handwritten notes, (9) create charts/graphs/diagrams, (10) create slides,
  (11) write a thesis or dissertation, (12) create an academic CV, (13) create
  a poster, (14) create an exam/quiz, (15) create a book, (16) convert between
  document formats (Markdown, DOCX, HTML to/from LaTeX), (17) generate Mermaid
  diagrams for LaTeX, (18) create a formal business letter, (19) create a cheat
  sheet or reference card, (20) create an exam formula sheet or crib sheet,
  (21) condense lecture notes/PDFs into a cheat sheet,
  (22) create a fillable PDF form with text fields/checkboxes/dropdowns,
  (23) create a document with conditional content/toggles (show/hide sections),
  (24) generate batch/mail-merge documents from CSV/JSON data,
  (25) create a version diff PDF (latexdiff) highlighting changes between documents,
  (26) create a homework or assignment submission with problems and solutions,
  (27) create a lab report with data tables, graphs, and error analysis,
  (28) encrypt or password-protect a PDF,
  (29) merge multiple PDFs into one,
  (30) optimize/compress a PDF for web or email,
  (31) lint or check a LaTeX document for common issues,
  (32) count words in a LaTeX document,
  (33) analyze document statistics (figures, tables, citations),
  (34) fetch BibTeX from a DOI,
  (35) convert a Graphviz .dot file to PDF/PNG,
  (36) convert a PlantUML .puml file to PDF/PNG,
  (37) create a one-pager/fact sheet/executive summary,
  (38) create a datasheet or product specification sheet,
  (39) extract pages from a PDF (page ranges, odd/even),
  (40) check LaTeX package availability before compiling,
  (41) analyze citations and cross-reference with .bib files,
  (42) debug LaTeX compilation errors,
  (43) make a document accessible (PDF/A, tagged PDF),
  (44) create lecture notes or course handouts,
  (45) fill an existing PDF form (fillable fields or non-fillable with annotations),
  (46) extract text or tables from a PDF (pdfplumber, pypdf),
  (47) OCR a scanned PDF to text (pytesseract),
  (48) create a PDF programmatically with reportlab (Canvas, Platypus),
  (49) rotate or crop PDF pages (pypdf),
  (50) add a watermark to an existing PDF,
  (51) extract metadata from a PDF (title, author, subject).
---

# LaTeX Document Skill

Create any LaTeX document, compile to PDF, and generate PNG previews. Convert PDFs of any type to LaTeX.

## Workflow: Create Documents

1. Determine document type (resume, report, letter, invoice, article, thesis, academic CV, presentation, poster, exam, book, cheat sheet)
2. **If the target is an IEEE journal / Transactions / IEEE two-column paper:** Read [references/ieee-journal-twocolumn-guide.md](references/ieee-journal-twocolumn-guide.md) before choosing a template. Start from `examples/ieee-twocolumn-sample.tex` for a working IEEEtran baseline and use `examples/ieee-twocolumn.png` / `examples/ieee-twocolumn-p1.png` / `examples/ieee-twocolumn-p2.png` as visual references.
3. **If poster:** Run the poster sub-workflow (see [Poster Sub-Workflow](#poster-sub-workflow) below), then skip to step 5.
4. **If cheat sheet / reference card:** Run the cheat sheet sub-workflow (see [Cheat Sheet / Reference Card Sub-Workflow](#cheat-sheet--reference-card-sub-workflow) below), then skip to step 5.
5. **Ask the user which enrichment elements they want** (use AskUserQuestion tool with multiSelect). Offer relevant options based on document type:
   - **AI-generated images** -- custom illustrations, diagrams, photos (uses generate-image skill)
   - **Charts/graphs** -- bar, line, pie, scatter, heatmap (pgfplots or matplotlib)
   - **Flowcharts/diagrams** -- process flows, architecture, decision trees (TikZ or Mermaid)
   - **Citations/bibliography** -- academic references, footnotes, works cited (BibTeX/biblatex)
   - **Tables with data** -- comparison matrices, financial data, statistics (booktabs)
   - **Watermarks** -- DRAFT, CONFIDENTIAL, or company logo background
   - Skip this step for simple documents (cover letters, invoices) or when the user has already specified exactly what they want.
6. Copy the appropriate template from `assets/templates/` or write from scratch
7. Customize content based on user requirements
8. Generate external assets based on user's element choices:
   - AI images: `python3 <skill_path>/../generate-image/scripts/generate_image.py "prompt" --output ./outputs/figure.png`
   - matplotlib char

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit f960611

git clone https://git.overleaf.com/PROJECT_ID local-copy
pip install pre-commit
pip install dot2tex
npm install -g @mermaid-js/mermaid-cli
pip install matplotlib numpy pandas seaborn
pip install scipy scikit-learn

Commands as the repository documents them: shown, never run by us. Our verdict covers commit f9606116daba only.

Works in which agents?

What its own text says, not a test

AgentStatusMore
Claude CodeMentioned in its text, not testedSkills for Claude Code · About Claude Code
CursorMentioned in its text, not testedSkills for Cursor · About Cursor
“Mentioned” means the skill’s text names the agent. We have not run it there.

Audit history

Every audit, every source change

  1. ✕BLOCK F 59 / 100

    first audit · source f9606116daba

Similar skills

latex-document-skill✕BLOCK

ndpvt-web/latex-document-skill

Universal LaTeX document skill: create, compile, and convert any document to professional PDF with PNG previews. Supports resumes, reports, cover letters, invoices, academic papers, theses/dissertations, academic CVs,…

★ 792Grade F
Paper Analyzer✓SAFE

zsyggg/paper-craft-skills

将学术论文转化为深度HTML长文。6轮强制工作流、代码仓库搜索、公式渲染、Mermaid图表。 3种写作风格,输出可直接分享的精美HTML页面。

★ 1.4kGrade B
Paper Comic✓SAFE

zsyggg/paper-craft-skills

论文方法图解——用视觉图解彻底讲清楚一篇论文到底做了什么、怎么做的。 自动分析论文核心方法,先推荐封面/概述图/机制细节图的生成方案,必须由用户确认范围、张数、语言、风格后再生成。 支持温暖笔记风和论文框架图风。

★ 1.4kGrade B
Paper Deck✓SAFE

zsyggg/paper-craft-skills

将论文、技术文章或知识内容制作成高真实感的 AIGC 幻灯片。先做叙事结构和逐页视觉导演,再调用生图模型生成每一页 16:9 slide image,最后合成为 PPTX/PDF。适合论文汇报、组会、公开课、技术分享、商业化研究展示;当用户提到“论文PPT”“AI生成PPT”“不像AI的PPT”“高质感幻灯片”“逐页生图PPT”时使用。

★ 1.4kGrade B
academic-pptx✓SAFE

gabberflast/academic-pptx-skill

Use this skill whenever the user wants to create or improve a presentation for an academic context — conference papers, seminar talks, thesis defenses, grant briefings, lab meetings, invited lectures, or any…

★ 1.3kGrade B
njucli!CAUTION

MarcWebber/njucli

登录南京大学统一身份认证、保存本地凭据、查询与维护会话状态、协助处理登录滑块验证。在涉及校园登录或会话失效时使用。

★ 2Grade C

Questions about latex-document

What does the latex-document skill do?
Universal LaTeX document skill for Claude Code: 27 templates, 27 scripts, 26 reference guides. Made with Claude Code on ✦ HappyCapy AI ✦ platform
Is latex-document safe to install?
No — not without reading the findings first. The audit graded it F (59/100) and found 6 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What can latex-document access on my machine?
The audit observed that it reaches the network and runs shell commands. Each of those is consistent with what it says it does. Secrets in the source: none found.
Which assistants does latex-document work with?
Its documentation mentions claude-code and cursor. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (f9606116daba), read on 2026-10-20. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.