Paperless

• Analyzed: May 12, 2026, 3:02 AM
• Findings: 1
• Version: 1.1.0
• Hash: a77a3252c2fbd06f96e1037bfaa9d59706ca067aaa4ddea21d97448e41c9708d
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as benign. The `SKILL.md` file clearly defines the purpose of interacting with Paperless-NGX via the `ppls` CLI. It requires `PPLS_HOSTNAME` and `PPLS_TOKEN` environment variables, which are necessary for its stated functionality and are not exfiltrated. The installation instructions specify a known npm package (`@nickchristensen/ppls`), and all command examples are legitimate operations for a document management system, including downloading files to the user's `~/Downloads` directory. There is no evidence of malicious prompt injection, data exfiltration, unauthorized execution, or persistence mechanisms.