Security Audit

Typst & LaTeX Compiler

github.com/openclaw/skills

AI SkillCommit 13146e6a3d46

CAUTION

Scanned about 2 months ago

Critical

Immediate action required

High

Priority fixes suggested

Medium

Best practices review

Low

Acknowledged / Tracked

Trust Assessment

Typst & LaTeX Compiler received a trust score of 56/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.

SkillShield's automated analysis identified 4 findings: 0 critical, 2 high, 2 medium, and 0 low severity. Key findings include Suspicious import: requests, Potential data exfiltration: file read + network send.

The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The Static Code Analysis layer scored lowest at 56/100, indicating areas for improvement.

Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.

Layer Breakdown

Manifest Analysis

100%

Static Code Analysis

56%

Dependency Graph

100%

LLM Behavioral Safety

100%

Behavioral Risk Signals

Network Access

4 findings

Filesystem Write

2 findings

Excessive Permissions

2 findings

Security Findings4

Severity	Finding	Layer	Location
HIGH	Potential data exfiltration: file read + network send Function 'compile_latex' reads files and sends data over the network. This may indicate data exfiltration. Review this function to ensure file contents are not being sent to external servers.	Static	skills/gregm711/typetex/examples/compile_latex.py:35
HIGH	Potential data exfiltration: file read + network send Function 'compile_typst' reads files and sends data over the network. This may indicate data exfiltration. Review this function to ensure file contents are not being sent to external servers.	Static	skills/gregm711/typetex/examples/compile_typst.py:35
MEDIUM	Suspicious import: requests Import of 'requests' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration.	Static	skills/gregm711/typetex/examples/compile_latex.py:4
MEDIUM	Suspicious import: requests Import of 'requests' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration.	Static	skills/gregm711/typetex/examples/compile_typst.py:4

Scan History

Embed Code

[![SkillShield](https://skillshield.io/api/v1/badge/d5df6f1147d3d05a.svg)](https://skillshield.io/report/d5df6f1147d3d05a)