The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's plot and plot-batch modes generate Python (matplotlib) code via a VLM and execute it on the host system. Because the VLM's generation is influenced by untrusted external data (CSV or JSON files), an attacker could use indirect prompt injection to cause the generation and execution of malicious Python code.
[EXTERNAL_DOWNLOADS]: The scripts/install.sh and scripts/run-mcp.sh files install the paperbanana package from public registries and run it via uvx. The package is sourced from a repository (llmsresearch/paperbanana) that is not identified as a trusted organization or the skill's official vendor, posing a supply chain risk.
[PROMPT_INJECTION]: The skill is designed to ingest and process untrusted PDF, Markdown, and text files to generate diagrams. These ingestion points (--input paper.pdf, --context method.txt) lack boundary markers or sanitization, creating a high-risk surface for indirect prompt injection that could manipulate the figure generation or the code generated in the plot mode.
[EXTERNAL_DOWNLOADS]: The paperbanana data download command fetches approximately 254 MB of reference data from an unspecified external source. While noted as verified by SHA256 in documentation, the binary's integrity and the source URL's reputation are not independently verified.
[COMMAND_EXECUTION]: The skill provides several shell scripts (scripts/run.sh, scripts/run-mcp.sh) that pass user-supplied arguments directly to shell commands. While used for legitimate CLI operations, the complexity of the command surface increases the risk of command injection if not properly handled by the underlying paperbanana binary.

paperbanana