ClawHub
Back to skill

Security audit

Paperless

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Paperless-NGX helper that uses a documented CLI and API token to search, download, upload, and organize documents.

Install only if you trust the ppls CLI and are comfortable granting it access to your Paperless-NGX instance. Use the narrowest token permissions available, avoid exposing the token in logs or shared terminals, and confirm document IDs, file paths, and metadata before running uploads or updates.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The setup instructions tell users to set an API token directly on the command line without any warning about credential sensitivity, storage location, shell history exposure, or least-privilege handling. In a skill intended for automation, this increases the chance that secrets are logged, copied into transcripts, or mishandled by users and agents.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill includes upload, create, and update commands that modify server-side documents and metadata, but it does not clearly warn that these are state-changing operations. In an agent/automation context, lack of read-only vs write-action labeling can lead to unintended document uploads, metadata corruption, or organizational changes on the Paperless-NGX instance.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.