paperless-ngx-tools
v1.0.2Manage documents in Paperless-ngx - search, upload, tag, and retrieve.
⭐ 3· 2.1k·3 current·4 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description, API reference, and scripts all align with managing Paperless-ngx documents. One mismatch: the package includes NodeJS scripts and the SKILL.md shows commands like `node {baseDir}/scripts/...`, but the registry metadata lists no required binaries — it should declare `node` (or `nodejs`) as a required binary.
Instruction Scope
SKILL.md instructs the agent to call local scripts and document the two env vars. The scripts only access PAPERLESS_URL/PAPERLESS_TOKEN and the Paperless API, read/write local files for upload/download, and fetch metadata — all within the expected scope.
Install Mechanism
No install spec is provided (instruction + bundled scripts). No remote downloads or archive extraction are performed by the skill. This lowers installation risk.
Credentials
Only PAPERLESS_URL and PAPERLESS_TOKEN are required and the primary credential is PAPERLESS_TOKEN — appropriate and proportional for talking to a Paperless-ngx instance.
Persistence & Privilege
always: false and no special persistence or cross-skill/system configuration changes. The skill does perform file I/O (upload/download) as expected, but it does not request elevated or persistent privileges.
Assessment
This skill appears to do what it claims: run the included Node scripts to manage Paperless-ngx via its API. Before installing: 1) Ensure you have Node.js available locally (SKILL.md uses `node` but the registry entry didn't list it). 2) Only set PAPERLESS_URL to a trusted Paperless host and store PAPERLESS_TOKEN securely (the token gives API access to your documents). 3) Review the uploaded/download paths you use (the scripts will read local files for upload and write files for download). 4) Because the skill can be invoked by the agent, consider whether you want autonomous runs using that token; revoke/regenerate the token in Paperless if you later stop using the skill. If you need higher assurance, inspect the bundled scripts yourself (they are included) before running.Like a lobster shell, security has layers — review code before you run it.
latestvk974wkrhr0ncrat8p1pdgc001d7zyf2n
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
EnvPAPERLESS_URL, PAPERLESS_TOKEN
Primary envPAPERLESS_TOKEN