Paperless-ngx Document Manager

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:45 AM UTC
• Version: 1.0.0

Overview

This Paperless-ngx skill is mostly purpose-aligned, but it has review-worthy risks around insecure HTTP use, broad document-management authority, and unsafe downloads that can overwrite local files.

Install only if you trust the configured Paperless server and understand that the skill can read, upload, download, and modify document data using your API token. Prefer HTTPS, use a least-privilege Paperless token, avoid --full on sensitive or very large documents, specify safe download output paths, and be cautious with the advanced API reference because it includes destructive operations.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:13

Finding

API Token and Sensitive Document Data Can Be Transmitted over Plaintext HTTP

Content

View full analysis

fs.readFile(filePath)); const blob = new Blob([fileBuffer]); formData.append('document', blob, basename(filePath)); if (values.title) { formData.append('title', values.title); } if (values.created) { formData.append('created', values.created); } // Upload const res = await fetch(`${baseUrl}/api/documents/post_document/`, { method: 'POST', headers: { 'Authorization': `Token ${PAPERLESS_TOKEN}` }, body: formData }); ``` The metadata-management scripts use the same transport pattern. For example: ```js const res = await fetch(`${baseUrl}/api/document_types/`, { method: 'POST', headers: { 'Authorization': `Token ${PAPERLESS_TOKEN}`, 'Content-Type': 'application/json' }, body: JSON.stringify({ name: values.create }) }); ``` ### Technical Analysis Sending the Paperless token to the configured Paperless API is necessary for the declared functionality. ...[truncated 2096 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/download.mjs:44

Finding

Server-Controlled Download Filename Allows Path Traversal and Arbitrary File Overwrite

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill requires environment variables and makes networked API calls, but the manifest does not declare any explicit tool scope such as permissions or allowed-tools. That weakens least-privilege controls and transparency, making it easier for an agent runtime to invoke network and secret-dependent behavior without clear user review.

Content

No source excerpt is available for this finding.

Unbounded Output

Medium

• Category: Output Handling
• Confidence: 81% confidence

Finding

The --full option explicitly disables truncation for OCR text content, which can cause very large or sensitive document contents to be emitted in full. In an agent setting, unbounded output increases the risk of context flooding, accidental disclosure of confidential data, and degraded reliability if large documents are retrieved.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

Include OCR text content

node {baseDir}/scripts/get.mjs 28 --content

Full content (no truncation)

node {baseDir}/scripts/get.mjs 28 --content --full

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation instructs the agent to upload local files and download remote documents to disk without any warning about data leaving the local environment or files being written locally. In a document-management skill, this can expose sensitive records or overwrite/create files if an agent follows the examples without explicit user confirmation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest describes this skill as managing documents by searching, uploading, tagging, and retrieving. This reference file advertises additional operations such as deleting documents, testing mail accounts, creating saved views, and accessing statistics, which go beyond that narrower stated scope and indicate broader behavior than the manifest claims.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file lists a DELETE endpoint for documents but does not include any warning that using it may permanently remove user data. For markdown files, destructive behaviors that can affect user data should be disclosed so users understand the risk before invoking them.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The documentation exposes DELETE endpoints for tags, document types, and correspondents, but provides no warning about the consequences of removing organizational metadata. In markdown skill documentation, operations that may affect user data integrity should be accompanied by explicit cautions.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 100)May include surrounding context.

Update document metadata

bash

curl -X PATCH \
  -H "Authorization: Token $PAPERLESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"title": "New Title", "correspondent": 5, "tags": [1, 2]}' \

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

While tagging documents is within scope, this file documents full CRUD operations for tags, document types, and correspondents, including creating, updating, and deleting those entities. Those administrative capabilities are broader than the manifest's concise description of searching, uploading, tagging, and retrieving documents.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.