TeX Render

Renders LaTeX math to PNG, JPEG, WebP, or AVIF images using MathJax (TeX→SVG) and @svg-fns/svg2img. Invoke whenever the agent needs to output LaTeX as a view...

This skill appears to do exactly what it says: convert LaTeX to images using MathJax and svg2img/Sharp. Before enabling: 1) Note the skill will automatically render and send images whenever the agent would output LaTeX — if you want to approve each render, do not enable it. 2) Installation requires running npm install in the skill folder and may compile sharp (ensure Node 14+ and build tools if on platforms requiring native builds). 3) The CLI writes files by default to ~/.openclaw/media/tex-render — monitor disk use and permissions. 4) Because npm packages can change, consider reviewing the published package contents (or running npm install in a sandbox) to confirm the dependencies are the expected MathJax/svg2img/sharp. 5) The validate script uses child_process to run tests locally (no network). If you want stricter privacy/control, avoid enabling automatic triggering in TOOLS.md and only invoke the skill when explicitly requested.

Type: OpenClaw Skill Name: tex-render Version: 1.1.4 The `scripts/render.js` file contains a path traversal vulnerability. The `output_base_path` argument, if controlled by an attacker, can be used to write files to arbitrary locations on the filesystem outside the intended `~/.openclaw/media/tex-render/` directory. While there is no explicit malicious intent (e.g., data exfiltration, persistence) within the provided code or agent instructions (`SKILL.md`), this vulnerability allows for potential arbitrary file writes, which is a significant security flaw.