Auto Paper Writer

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ConcernHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

Running the workflow as written could delete unrelated Desktop files, including personal Python scripts, PowerShell scripts, or versioned presentation files.

Why it was flagged

The cleanup command is not scoped to the paper project or files created by the skill. It force-deletes all matching files on the user's Desktop, which can remove unrelated scripts or presentations.

Skill content

Remove-Item "$env:USERPROFILE\Desktop\*.ps1" -Force
Remove-Item "$env:USERPROFILE\Desktop\*.py" -Force
Remove-Item "$env:USERPROFILE\Desktop\*_v*.pptx" -Force

Recommendation

Do not run the cleanup commands as written. Restrict cleanup to a dedicated project/temp folder and delete only files the skill created, preferably after explicit user confirmation.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

The workflow may fail or run unexpected local tooling if the user’s environment differs from the hardcoded examples.

Why it was flagged

The instruction-only skill relies on local Python/matplotlib and TeX Live tooling, while the registry metadata declares no required binaries. This is understandable for the stated purpose, but users should verify their local tools and paths before use.

Skill content

使用 matplotlib 生成 300dpi 高质量图片 ... 使用 **TeX Live**（不是 Tectonic）编译

Recommendation

Declare and verify required local tools explicitly, and replace hardcoded paths with user-specific, confirmed paths.