Paper Engineering Assistant

• Analyzed: May 14, 2026, 5:00 AM
• Findings: 1
• Version: 1.0.1
• Hash: 88e243b4812efbf17279aadfe21a7a4dfb32341c4b11f4f3bee3812b8a03768d
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill requests broad permissions, including 'Filesystem read/write' and 'network access', as declared in SKILL.md. While these permissions are plausible for an academic writing assistant, the instructions in SKILL.md for the agent to parse arbitrary reference files (e.g., PDFs) and perform network downloads based on user-provided keywords introduce significant vulnerability risks. These capabilities could be exploited through parser vulnerabilities or by tricking the agent into downloading/processing malicious content or performing SSRF, even though the provided `agent.py` code does not explicitly implement these risky parsing/downloading functions, nor does it show clear malicious intent.