Paperless
v1.1.0Interact with Paperless-NGX document management system via ppls CLI. Search, retrieve, upload, and organize documents.
⭐ 1· 2.8k·14 current·14 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The SKILL.md instructions and description match: they drive the ppls CLI to interact with Paperless-NGX (search, download, upload, metadata). However, registry-level metadata provided to you earlier shows no required binaries or env vars while the SKILL.md includes metadata that requires the ppls binary and env vars (PPLS_HOSTNAME, PPLS_TOKEN). This is likely a packaging/metadata omission rather than a functional mismatch, but it is an inconsistency you should be aware of.
Instruction Scope
Runtime instructions are narrowly scoped to installing/configuring/running the ppls CLI and using it to query and manage documents on a Paperless-NGX host. The doc tells the agent to run ppls commands and set hostname/token; it does not instruct reading unrelated files or exfiltrating data to third-party endpoints.
Install Mechanism
The SKILL.md recommends installing @nickchristensen/ppls via npm (global install). This is a common, expected mechanism for a CLI wrapper but is higher-risk than an instruction-only skill because it executes third-party code from npm. The referenced GitHub project exists (https://github.com/NickChristensen/ppls), which reduces but does not eliminate risk; you should review the package and prefer a trusted install method.
Credentials
The only credentials/configuration the skill needs (per SKILL.md metadata) are the Paperless hostname and API token (PPLS_HOSTNAME, PPLS_TOKEN), which are proportional to its purpose. No unrelated secrets or multiple service credentials are requested. Note again the registry metadata omitted these env requirements.
Persistence & Privilege
The skill does not request always:true, does not demand persistent elevated privileges, and does not attempt to change other skills' configurations. It appears to be an ordinary user-invocable skill with no special platform privileges.
Assessment
This skill looks coherent for controlling Paperless-NGX via the ppls CLI, but before installing: 1) Verify the npm package identity and maintainer (check the GitHub repo and package contents) to ensure you’re installing the legitimate @nickchristensen/ppls package. 2) Prefer installing without -g (or use a container/venv) if you want to limit global code execution, and avoid running npm as root. 3) Confirm where ppls stores the configured token (config file) and protect that file (restrict filesystem permissions); consider a least-privilege API token for Paperless. 4) Double-check the registry metadata mismatch (top-level metadata showed no required env vars/bins while SKILL.md does) — treat that as a packaging issue to clarify with the publisher. 5) If you cannot vet the package, consider manually invoking Paperless-NGX API calls or using a known trusted client instead.Like a lobster shell, security has layers — review code before you run it.
latestvk9754n5d8sj7rwdsjh0xwww91s8056pb
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Binsppls
EnvPPLS_HOSTNAME, PPLS_TOKEN
Install
Install ppls CLI (npm/bun)
Bins: ppls
npm i -g @nickchristensen/ppls