paper-notion-summarizer

• Analyzed: May 11, 2026, 4:39 AM
• Findings: 1
• Version: 1.0.0
• Hash: 8a48c6b1d059af9f29c5f71a924ee0b320c4a6d73851004a0fa6c7ca0888585c
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to significant vulnerabilities in `scripts/extract_paper.py`. This script fetches content from URLs derived from user input (via `query`, `doi`, `arxiv-id` arguments), creating a potential Server-Side Request Forgery (SSRF) vulnerability. Additionally, the `--output` argument allows writing to an arbitrary file path, posing an arbitrary file write vulnerability. These flaws could be exploited if the agent's inputs are manipulated through prompt injection, potentially leading to unauthorized data access or system compromise, despite the script's intended benign purpose of fetching paper content.