paper-reader
Pass
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads academic PDF files from
arxiv.orgusingcurl. This is the primary intended function of the skill and targets a well-known, trusted academic repository.- [COMMAND_EXECUTION]: The skill workflow involves executing several local scripts and system utilities, includingpython3for text/figure extraction,xelatexfor PDF compilation, andtlmgrfor TeX package management. These operations are necessary for the skill's stated purpose of generating typeset academic reports.- [REMOTE_CODE_EXECUTION]: The skill performs one-time installations of thepymupdfPython package and various TeX Live packages. These installations use official package registries (PyPIand theTeX Liverepository) and are standard for maintaining the required execution environment.- [PROMPT_INJECTION]: The analysis guidelines inreferences/analysis-prompt.mdestablish a professional academic persona and emphasize factual accuracy and rigorous reporting. No patterns of safety bypass or malicious instruction overrides were detected.- [DATA_EXFILTRATION]: Network access is restricted to fetching PDF content from arXiv. There are no patterns suggesting the exfiltration of sensitive local data or credentials.
Audit Metadata