Paper Management System

文献管理系统 - 自动化PDF文献索引、搜索、AI提炼工具。当用户需要管理PDF文献、自动索引、搜索文献、提取元数据时激活。

Security Scan

The skill's files largely match a PDF-management purpose, but there are a few inconsistencies and behaviors (un-declared required system binaries and arbitrary shell execution for notifications, plus an advertised OpenAI integration that the code doesn't actually call) that warrant caution before installing.

Purpose & Capability

Name/description match the included scripts: indexing, renaming, full-text extraction, and AI summarization. However, the metadata/README/requirements advertise OpenAI/Anthropic integration while ai_summarize.py contains only local heuristic text-processing (no openai/anthropic calls). Also the package expects system tools (python3, sqlite3 CLI, md5sum) although the skill's declared required binaries list is empty — a mismatch between declared requirements and actual script assumptions.

Instruction Scope

Runtime instructions (cron or manual) run the bundled shell and Python scripts which read/write local PDFs, logs, and an SQLite DB — that's expected. But ai_summarize.py's send_notification executes a configured notification command via shell (subprocess.run(..., shell=True)) and auto_index.sh invokes the sqlite3 CLI and moves/removes files; both allow arbitrary commands if the notification command or environment is misconfigured. The SKILL.md does not sufficiently warn users that notification configuration may run arbitrary shell commands or send data externally.

Install Mechanism

There is no installer that downloads code from external URLs; this is provided as source files and a requirements.txt. Installation is the usual pip install -r requirements.txt per README. No high-risk remote downloads or extract-from-URL steps are present.

Credentials

Environment variables are limited and appropriate for a local paper manager (PAPERMGR_* dirs, DB path, PAPERMGR_AI_ENABLED, OPENAI_API_KEY optional). That said, OPENAI_API_KEY is advertised as an option but the included ai_summarize.py does not use the OpenAI/Anthropic libraries — inconsistent documentation vs code. Also the skill.json marks OPENAI_API_KEY as sensitive (expected) and network access to api.openai.com is listed as optional; requiring that key would be proportionate only if the code actually used it.

Persistence & Privilege

The skill is not always-enabled, requests no platform-level privileges, and does not modify other skills or system-wide settings. It does read/write local filesystem paths under the project (papers, downloads, data, logs) which is expected for its purpose.

What to consider before installing

This package appears to be a legitimate local PDF management tool, but review these before installing: - Notification command risk: The notification feature executes whatever you configure as notification.cmd using a shell. Do not set this to an untrusted URL fetcher or arbitrary command; prefer 'stdout' or a vetted relay program. Treat notification.cmd as able to exfiltrate summaries if misconfigured. - Declaration mismatches: The scripts assume common system utilities (python3, sqlite3 CLI, md5sum) though the skill metadata lists no required binaries. Ensure these are available and run the tool in a controlled environment (container/VM) first. - OpenAI/Anthropic inconsistency: README/requirements mention OpenAI/Anthropic, but the summarizer code does not call those APIs. If you plan to enable networked AI summarization, inspect/modify code to use the provider safely and only supply an API key after review. - Sanity checks: Inspect config.yaml or env vars before running; back up any important PDF folders and the DB; run the scripts with notification disabled initially to confirm behavior; consider running in an isolated user account or container to limit filesystem access. If you want higher confidence, ask the publisher for a canonical repository or provenance (the skill references a GitHub URL); verify that the packaged code matches that upstream source and that any AI/networking calls are explicit and audited.

文献管理系统 - 自动化 PDF 文献管理工具（v2.0）

功能特性

• 自动索引：扫描 PDF，提取元数据
• 智能搜索：按关键词/年份/作者搜索
• AI 提炼：生成结构化摘要
• 自动重命名：作者_年份_关键词.pdf
• 增量处理 + Hash 去重
• 飞书通知（需 feishu-relay）

所需环境变量

变量名	必须	说明
PAPERMGR_PAPERS_DIR	否	PDF 存储目录（默认 ./papers）
PAPERMGR_DOWNLOADS_DIR	否	下载目录（默认 ./downloads）
PAPERMGR_DATABASE_PATH	否	数据库路径（默认 ./data/index.db）
PAPERMGR_AI_ENABLED	否	启用 AI（默认 false）
OPENAI_API_KEY	否	OpenAI API Key

调用方式

自动（cron）

*/30 * * * * /path/to/scripts/auto_index.sh

手动

python3 scripts/paper_manager.py index    # 索引
python3 scripts/paper_manager.py rename   # 重命名
python3 scripts/paper_manager.py search <关键词>  # 搜索
python3 scripts/paper_manager.py status   # 状态

输入

• PDF 文件（放入 downloads/ 或 papers/ 目录）

输出

• SQLite 数据库（data/index.db）
• 重命名后的 PDF 文件
• AI 摘要（ai_summary 字段，可选）
• 飞书通知（可选）

发布信息

• 版本：v2.0.0
• 许可证：MIT
• GitHub：https://github.com/crayfish-ai/paper-management-system