Paperless-ngx

• Analyzed: May 12, 2026, 3:05 AM
• Findings: 1
• Version: 1.0.0
• Hash: 26b3cceaf9bc6d57449c47df155651aa781157211b0293c454def6082f4be250
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is designed to interact with the Paperless-ngx REST API, requiring `PAPERLESS_URL` and `PAPERLESS_TOKEN` environment variables. All `curl` commands demonstrated in `SKILL.md` are directly related to document management operations (search, upload, download, delete, metadata updates, tag/correspondent/document type management) against the user-configured Paperless-ngx instance. While it involves network calls and local file operations (for document upload/download), these are essential for the skill's stated purpose and show no evidence of malicious intent, data exfiltration to unauthorized endpoints, prompt injection against the agent, or other harmful behaviors.