paper-read
Pass
Audited by Gen Agent Trust Hub on Nov 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill makes extensive use of local shell commands via
subprocess.runandos.execvpto coordinate between sibling tools (p2z.py,ocr.py) and standard utilities likepdftotext. These operations are fundamental to the skill's purpose of local file management and Zotero integration and do not involve unsanitized external input. - [EXTERNAL_DOWNLOADS]: The skill references sibling dependencies
paper-to-zoteroandpaddleocr. While these are external extensions, they are treated as trusted components of the user's research environment. Standard tools likepoppler(forpdftotext) anduv(for Python script execution) are also expected requirements for this type of technical agent skill. - [SAFE]: No evidence of prompt injection, data exfiltration to unauthorized domains, or malicious persistence mechanisms was found. The logic focuses on bibliographic data management and local document analysis.
Audit Metadata