paperbanana

SUSPICIOUS: the skill’s core purpose and requested credentials mostly align with academic figure generation, and the package has coherent GitHub/PyPI provenance. However, the install path in the skill relies on local bash wrapper scripts not clearly matched by public docs, and the MCP/agent surface plus untrusted document processing increase execution risk beyond a simple documentation skill.