Paperzilla
v0.3.1Use the Paperzilla CLI (pz) to browse research projects and feeds, inspect canonical papers and project recommendations, leave feedback, export JSON, and gen...
⭐ 2· 647·2 current·2 all-time
byMark Pors 🦖@pors
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description map directly to using the Paperzilla CLI. The only declared required binary is pz, which is exactly what the skill instructs the agent to run; no unrelated credentials, binaries, or config paths are requested.
Instruction Scope
SKILL.md instructs the agent to run pz commands, prefer --json, and use pz login for authenticated commands. It does not ask the agent to read unrelated files, system secrets, or to exfiltrate data to unexpected endpoints. It does mention an optional PZ_API_URL configuration.
Install Mechanism
The skill is instruction-only (no install spec). The docs include common install commands (Homebrew, Scoop, GitHub release tarball via curl|tar, or build from source). These are typical for CLI tooling but include a curl|tar pipeline and sudo mv which download and place binaries on the system — a normal pattern but higher-risk if you blindly run it. The instructions point at GitHub releases and official taps/repos, which is expected.
Credentials
Manifest lists no required env vars. SKILL.md references an optional PZ_API_URL and requires interactive login (pz login) for project-specific commands. This is proportionate, but there's a small mismatch: the docs mention an env var users may set, but the skill metadata does not declare it as required (which is fine if optional). No unexplained secrets or unrelated environment variables are requested.
Persistence & Privilege
always is false and the skill does not request persistent system-wide privileges. The instructions may move binaries into /usr/local/bin (standard for CLI tools) but the skill itself does not attempt to modify other skills or system configurations beyond normal installation steps.
Assessment
This skill is an instruction-only wrapper around the Paperzilla CLI (pz). Before installing or running pz: prefer installing via your system package manager (Homebrew/Scoop) rather than piping curl|tar; if you must use the release tarball, verify the GitHub release and checksums. Understand what 'pz login' stores (where credentials/tokens are kept) and only point PZ_API_URL to trusted endpoints. Avoid running curl | tar with sudo from unverified sources and revoke tokens if you later suspect compromise.Like a lobster shell, security has layers — review code before you run it.
latestvk97fdfkxgnsmhnyx6b44hhszs9843c4r
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Binspz