deeppapernote

Pass

Audited by Gen Agent Trust Hub on Jul 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The orchestration script run_pipeline.py executes local helper scripts using subprocess.run to manage the multi-stage document processing pipeline.
  • [EXTERNAL_DOWNLOADS]: The skill fetches paper metadata and PDF documents from established research repositories, including arXiv, Semantic Scholar, OpenAlex, and Crossref.
  • [DATA_EXFILTRATION]: The configuration logic in common.py reads local shell initialization files (e.g., .bashrc, .zshrc) to load specific environment variables for API keys. Additionally, check_environment.py scans standard directories (Documents, Desktop) to assist the user in locating their Obsidian vault.
  • [PROMPT_INJECTION]: Processing external PDF content introduces a surface for indirect prompt injection. The skill mitigates this by using an 'evidence-first' architecture that requires the model to ground its analysis in structured JSON manifests extracted from the source material.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 17, 2026, 03:10 AM
Security Audit — agent-trust-hub — deeppapernote