Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward Paperless-ngx API helper, but it exposes document deletion and bulk destructive operations without explicit preview or confirmation guidance.
Review this skill before installing if your Paperless-ngx instance contains sensitive or business-critical documents. Use the narrowest API token available, avoid unattended delete or bulk_edit requests, and require the agent to show exact document IDs and get explicit confirmation before deletion, reprocessing, or bulk metadata changes.
The bulk_edit example exposes mass-impact methods including delete and reprocess, but provides no safeguards, preview step, scope validation, or confirmation requirement. In a document-management skill, bulk destructive actions amplify the blast radius of mistakes or prompt injection, potentially affecting many documents at once.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s "$PAPERLESS_URL/api/documents/?query=invoice" \
-H "Authorization: Token $PAPERLESS_TOKEN"
The skill explicitly documents a DELETE operation for documents without requiring any confirmation, user-consent check, or warning about irreversible data loss. In an agent context, that omission is dangerous because the model may execute destructive actions from ambiguous or mistaken user requests, causing unintended deletion of records.
No suspicious patterns detected.