论文阅读助手

• Analyzed: Apr 3, 2026, 3:16 AM
• Findings: 1
• Version: 1.0.0
• Hash: 40397eb0720a0a83e06ec5a7fe78760ab18c5b5564ed2a52e2641c6760d855ef
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious due to the inclusion of an automatic dependency installer in `read_paper_main.py`. The script uses `subprocess.check_call` to execute `pip install` for several PDF-related libraries (pymupdf, pdfplumber, pypdf) if they are not found in the environment. While this behavior is documented in `SKILL.md` as a convenience feature for PDF analysis, the execution of system-level installation commands without explicit user confirmation is a high-risk capability that could be abused.