easypaper
v1.0.3Generate academic papers from metadata using EasyPaper Python SDK. Use when user wants to create structured LaTeX papers programmatically. References the Eas...
⭐ 0· 123·0 current·0 all-time
byYuwei Yan@pinkgranite
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The name/description align with the instructions: installing the EasyPaper Python SDK, a LaTeX toolchain, and Poppler are coherent for programmatic LaTeX/PDF generation. There are no unrelated binaries or credentials demanded. Minor inconsistency: the doc references an HTTP Typesetter fallback (AGENTSYS_SELF_URL) but that environment variable is not declared as required.
Instruction Scope
SKILL.md stays within the paper-generation scope (install SDK, prepare metadata.json/configs/dev.yaml, call EasyPaper.generate). It does, however, describe a fallback to an HTTP Typesetter endpoint (AGENTSYS_SELF_URL) if no local typesetter is available — that implies possible network transmission of document content to an external service. Also the instructions expect reading local config files (configs/dev.yaml) and metadata files (metadata.json), which is reasonable for the task but means local files and any secrets inside configs could be accessed by the SDK at runtime.
Install Mechanism
There is no platform install spec in the registry; the SKILL.md recommends 'pip install easypaper' and system package installs (TeX, poppler). Installing a Python package from PyPI runs third-party code on your system — normal for this use case but warrants caution: inspect the package source or run in an isolated environment (venv/conda) before trusting it.
Credentials
The skill declares no required env vars or credentials, which aligns with its purpose. However, SKILL.md references AGENTSYS_SELF_URL as an HTTP Typesetter fallback and expects config files (configs/dev.yaml). At runtime the SDK or plugin may read environment variables and config files not listed here; these could contain sensitive values. The absence of declared env vars reduces suspicion, but you should verify what the installed package actually reads.
Persistence & Privilege
The skill is not forced-always and has no install spec that would create persistent privileges; autonomous invocation is enabled (default) but that is expected. There is no evidence it attempts to modify other skills or system-wide agent settings.
Assessment
This skill is internally coherent for generating LaTeX papers, but take these precautions before installing or running it:
- Install and run inside an isolated environment (venv or conda) and avoid system-wide installation.
- Inspect the easypaper package source (PyPI/GitHub) before pip installing to confirm no unexpected behavior or network calls.
- Check configs/dev.yaml and any example config for embedded credentials; do not use sensitive metadata for initial tests.
- Ensure AGENTSYS_SELF_URL is unset or points to a trusted endpoint if you want to avoid automatic fallback to a remote typesetter (which would send document content over the network).
- Prefer testing with dummy/non-sensitive documents first and monitor network activity while the SDK runs.
If you want higher confidence, provide the actual package source (PyPI package link or repository tarball) so it can be further inspected; absence of code in the skill package means some risk comes from the external Python package it instructs you to install.Like a lobster shell, security has layers — review code before you run it.
latestvk97er2gerd7pykkgta7bvhjsyn83frtg
License
MIT-0
Free to use, modify, and redistribute. No attribution required.