Install
$ agentstack add skill-fcakyon-claude-codex-settings-review-overleaf ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Review Overleaf
Pull unresolved review threads from an Overleaf project, locate each in the local repo, propose edits the user reviews, and apply them. Does not push back to Overleaf — the web UI is still the place to mark threads resolved after the user verifies the local change.
Step 1: Resolve project ID
Accept any of:
- Raw 24-char hex ID (
^[0-9a-f]{24}$) - Full URL like
https://www.overleaf.com/project/— extract via regex - Project name in quotes — call:
``bash python3 ${CLAUDE_PLUGIN_ROOT}/scripts/overleaf_reviews.py --list-projects ` Each line is `. Fuzzy-match the name. If multiple match, AskUserQuestion to disambiguate.
If the user has not given a project ID at all, run --list-projects and show the user the table so they can pick one.
Step 2: Cookie precheck
If ~/.claude/overleaf-skills/cookie does not exist, tell the user to "set up overleaf" (which triggers the setup skill) and stop.
If it exists but auth fails (the next script call returns a refresh hint), point at the same setup skill and stop.
Step 3: Access-level guard
If the project ID came from name resolution, check the matched entry's accessLevel. If readOnly, warn:
> Project is read-only. You can edit local files but cannot sync them back to Overleaf via the web UI; you would need to copy-paste manually. Continue?
For owner, readAndWrite, or review, proceed silently.
Step 4: Fetch comments
python3 ${CLAUDE_PLUGIN_ROOT}/scripts/overleaf_reviews.py --json --repo . --unresolved-only
Parses to a JSON array. Each record has: thread_id, doc_id, snippet, offset, resolved, messages (list of {user, ts, content}), file, line. The file and line are null when the snippet did not match any local *.tex.
Step 5: Edit loop
For each record where file is non-null:
Readthe file atline± 5 lines for context.- Summarize the comment thread in one sentence: who said what.
- Propose a concrete edit grounded in the comment text. If the comment is a question (e.g., "did you mean X?"), the edit should answer it in the prose; if it's a correction (e.g., "wrong notation"), the edit should make the correction.
- Apply via
Edit. Do not batch — one comment, one edit, then move on.
Skip records where file is null (snippet did not map). Collect them in an `` list.
Step 6: Wrap up
After the loop:
- Run
git diffand show the user the full set of changes. - List the `
records (if any) withdoc_id` + snippet preview, so the user can hunt them manually. - Suggest a commit message in the style:
address overleaf review:. Do NOT auto-commit. The user can run/github-dev:commit-stagedor commit by hand. - Remind the user to mark the addressed threads as resolved in the Overleaf web UI once they verify the local diff.
Non-goals
- No re-upload to Overleaf (no write API used).
- No thread resolution in Overleaf (web UI only).
- No
.bibedits unless a comment specifically targets a citation. - No multi-line snippets that span paragraph breaks — those land in `` for v1; the snippet matcher is line-anchored.
Pairs naturally with
github-dev—/github-dev:commit-stagedafter the edit loop,/github-dev:create-prif the project is collaborative.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: fcakyon
- Source: fcakyon/claude-codex-settings
- License: Apache-2.0
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.