arXiv Paper Reviews

• Analyzed: May 12, 2026, 3:32 AM
• Findings: 1
• Version: 1.0.6
• Hash: 39499e11b237adbbfeb56a8c36561cdf1094cb2c17327545ed3f5932b55a97ea
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious primarily due to its reliance on an external API hosted at `http://weakaccept.top:8000/` (as seen in `SKILL.md`, `paper_client.py`, and `config.json`). This domain is not the official arXiv API, and its unusual name raises concerns about the trustworthiness and security of the third-party service. While the client code (`paper_client.py`) itself appears to perform its stated functions without direct malicious intent or local vulnerabilities, and no prompt injection attempts were found in `SKILL.md`, the dependency on this potentially untrusted external endpoint introduces a significant supply chain risk.