The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of local CLI tools (paperpile, scholar, bun) and shell scripts to perform library management and PDF resolution. These are standard for the tool's documented purpose.
[EXTERNAL_DOWNLOADS]: The skill downloads academic papers and metadata from well-known scholarly sources including CrossRef, SSRN, and various university library proxies (UVA, NYU). These operations are transparently documented as part of the core PDF resolution functionality.
[COMMAND_EXECUTION]: The script scripts/resolve_pdf.py uses subprocess.run to call curl and other local utilities for network requests and metadata lookups. Static analysis correctly identified these calls; however, they are used with hardcoded or sanitized parameters and do not pose an injection risk in this context.
[REMOTE_CODE_EXECUTION]: The skill interacts with Chrome via the Chrome DevTools Protocol (CDP) on port 9250 to automate browser-based PDF downloads and session warmup. This is a functional requirement for bypassing institutional SSO challenges and is not used for arbitrary code execution.
[CREDENTIALS_UNSAFE]: The skill manages authentication by snapshotting and hydrating browser cookies into local JSON files at ~/.claude-work/skills/paperpile/cookies/. While these files contain session data, they are stored within the user's local config directory with limited file permissions (chmod 600), following standard practice for CLI authentication persistence.

paperpile