claude-paper-webui
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute several lifecycle commands, including dependency installation (
npm ci), building the production assets (npm run build), and starting the Nuxt.js server as a background process usingnode. - [EXTERNAL_DOWNLOADS]: The skill invokes
npm cito download and install Node.js packages required for the web interface. These downloads target the standard npm registry. - [REMOTE_CODE_EXECUTION]: The skill executes locally built JavaScript files (
.output/server/index.mjs) using the Node.js runtime. This is the primary function of the skill to provide the web UI. - [DATA_EXPOSURE]: Uses
curlto verify the health of the local server athttp://localhost:5815/api/papers. This operation is confined to the local loopback address and does not involve external data transmission. - [PRIVILEGE_ESCALATION]: Manages process lifecycle using a PID file stored in
/tmp/claude-paper-webui.pidand thekillcommand. These are standard process management techniques within the user's permission scope.
Audit Metadata