paper-analyze

SUSPICIOUS: The core purpose is legitimate and mostly aligned with the capabilities, but the skill expands trust by executing unspecified local scripts and invoking other unverified skills, while also downloading/extracting remote paper source archives and processing untrusted external content with write/exec permissions. This is not confirmed malware or credential theft, but it carries medium security risk from supply-chain, transitive trust, and prompt-injection exposure.