paper-plan

SUSPICIOUS: the skill’s main purpose is benign paper-outline generation, and its data flow to OpenAI Codex is consistent with that purpose. However, the footprint is broader than necessary: wildcard Bash, web ingestion, optional arbitrary URL style references, and a directive to act silently on file writes increase risk. Same-org install references reduce supply-chain concern, but the combination of untrusted external content plus write/exec capability makes this skill medium risk.