Skills paper-2-web

📦

paper-2-web

Name: paper-2-web
Author: davila7

Content revision r1 High Risk ⚙️ External commands🌐 Network access🔑 Env variables

Create Research Websites from Papers

Academic papers are hard to turn into clear promotion assets. This skill guides Paper2All workflows for websites, videos, and posters.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "paper-2-web" from https://skillstore.io/skills/davila7-paper-2-web.md and its manifest at https://skillstore.io/api/skills/davila7-paper-2-web/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/davila7-paper-2-web.md Signed manifest GET /api/skills/davila7-paper-2-web/manifest Signed lockfile GET /api/skills/davila7-paper-2-web/lockfile

Test it

Using "paper-2-web". A LaTeX paper with figures, bibliography, and a request for a public project page.

Expected outcome:

A plan for an interactive homepage with sections for abstract, contributions, figures, methods, results, citations, and author links.

Using "paper-2-web". A conference paper that needs a poster and a three minute video abstract.

Expected outcome:

A production checklist covering poster dimensions, visual hierarchy, narration style, slide count, accessibility checks, and final review steps.

Using "paper-2-web". A lab folder containing several paper directories for public promotion.

Expected outcome:

A batch workflow that separates inputs and outputs, recommends model settings, and schedules website, poster, and video quality checks.

Security Audit

High Risk

v14 • 7/9/2026 Open versioned report

The skill has legitimate research-transformation intent, and I found no prompt injection attempt. Risks remain from third-party pipeline execution, sudo package installation, API keys, and external LLM or search services.

Files scanned

1,912

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (9)

High

references/installation.md:53

Environment file access

Create a `.env` file in the project root with the following credentials:

The guide instructs users to create a .env file containing credentials. That is legitimate setup, but the skill should treat the file as sensitive and prevent accidental disclosure.

High

references/installation.md:121

Environment file access

- Verify `.env` file is in the project root

The troubleshooting section explicitly checks for the .env file in the project root. This confirms the workflow depends on local secret files and should include secret hygiene controls.

High

references/installation.md:123

Environment file access

- Ensure no extra spaces or quotes around keys in `.env`

The guide gives formatting advice for keys in the .env file. This is safe operational guidance, but it still handles secrets that can be leaked through prompts, logs, or committed files.

High

references/installation.md:131

Environment file access

├── .env # API credentials

The documented project tree includes .env as the location for API credentials. This is a real sensitive-file pattern and needs warnings about version control and generated artifacts.

High

SKILL.md:139

Environment file access

2. **Configure API Keys** (create `.env` file):

The skill tells users to create a .env file for API keys. The usage is legitimate, but it introduces sensitive-file handling in the project workspace.

High

SKILL.md:372

Environment file access

- Verify API keys in `.env` file

The troubleshooting section instructs users to verify API keys in the .env file. This confirms the workflow accesses local secrets and should avoid exposing them in chat or output.

High

SKILL.md:130-136 references/installation.md:18-32

Unverified Third-Party Pipeline Installation

The skill directs users to clone Paper2All from GitHub and install requirements without a pinned commit, checksum, or dependency lock guidance.

The cited setup steps combine external repository cloning with dependency installation. The documentation does not provide integrity verification or pinning guidance.

Medium

SKILL.md:17 references/installation.md:77-84

Private Manuscript Data May Reach Third-Party LLMs

The workflow uses LLM-powered content extraction and supports OpenAI, OpenRouter, and Claude-backed model providers, which may process paper content.

The files explicitly describe LLM-powered processing and third-party model backends. This creates a privacy risk for unpublished or confidential manuscripts.

Show all 9 confirmed findings

Medium

references/paper2web.md:136-141 references/paper2poster.md:296-300

External Logo Search Downloads Third-Party Assets

The optional logo discovery feature uses Google Search API to find, download, and integrate institution logos into generated outputs.

The cited documentation states that the feature searches for official logos and downloads logo images. This creates network, attribution, and untrusted asset handling concerns.

Capability review items (15)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

references/installation.md:39

sudo privilege escalation

sudo apt-get install libreoffice poppler-utils

The installation guide instructs users to run sudo apt-get install, which modifies system packages with elevated privileges. This is legitimate dependency setup, but it still requires explicit trust and user confirmation.

High

references/installation.md:59

Generic API/secret keys

OPENAI_API_KEY=your_openai_api_key_here

The documentation asks users to place an OpenAI API key in a project .env file. This is a real secret-handling risk because the external pipeline will read credentials from the workspace.

High

references/installation.md:64

Generic API/secret keys

OPENROUTER_API_KEY=your_openrouter_api_key_here

The documentation asks users to place an OpenRouter API key in a project .env file. This is sensitive credential handling and needs clear storage and sharing safeguards.

High

references/installation.md:71

Generic API/secret keys

GOOGLE_API_KEY=your_google_api_key_here

The documentation asks users to place a Google API key in a project .env file for logo search. This exposes a real API credential to local tooling and generated workflows.

High

SKILL.md:131-137

Ruby/shell backtick execution

```bash

The quick start block clones an external repository, creates an environment, and installs dependencies. Running unpinned third-party code and packages is a real supply-chain risk.

High

SKILL.md:141

Generic API/secret keys

OPENAI_API_KEY=your_openai_api_key_here

The quick start asks users to place an OpenAI API key in a .env file. This is a genuine credential-handling risk in a community skill that runs external tooling.

High

SKILL.md:142

Generic API/secret keys

# Optional: GOOGLE_API_KEY and GOOGLE_CSE_ID for logo search

The quick start references Google API credentials for logo search. Optional credentials are still sensitive and need protection from logs, prompts, and generated files.

Medium

SKILL.md:50-52

Ruby/shell backtick execution

```bash

The cited bash block directs execution of a Python schematic-generation script. It is a documented workflow, but it still asks the agent or user to run local code.

Medium

SKILL.md:157-162

Ruby/shell backtick execution

```bash

The usage block instructs running pipeline_all.py with user-selected input and output paths. This is intended behavior, but it executes local pipeline code on user documents.

Medium

SKILL.md:165-171

Ruby/shell backtick execution

```bash

The website-only example runs pipeline_all.py from the external Paper2All project. This is legitimate usage, but it is still external command execution over local paper files.

Medium

SKILL.md:174-182

Ruby/shell backtick execution

```bash

The poster example runs pipeline_all.py with output and poster sizing arguments. The command is documented, but it executes local pipeline code and should require confirmation.

Medium

SKILL.md:185-191

Ruby/shell backtick execution

```bash

The video example runs pipeline_light.py with model and paper paths. This is a real command execution path, including possible API calls and heavy local processing.

Medium

SKILL.md:429-438

Ruby/shell backtick execution

```bash

The batch example runs pipeline_all.py repeatedly in a shell loop. It is an intended workflow, but it can launch multiple external processes, API calls, and filesystem writes.

Low

references/installation.md:20

Hardcoded URL

git clone https://github.com/YuhangChen1/Paper2All.git

The guide directs users to clone a fixed external GitHub repository. That network dependency is expected, but it creates supply-chain exposure if the repository changes or is compromised.

Low

SKILL.md:132

Hardcoded URL

git clone https://github.com/YuhangChen1/Paper2All.git

The quick start directs cloning a fixed external GitHub repository. This is expected setup, but it is still a network dependency with supply-chain risk.

Risk Factors

⚙️ External commands (50)

references/installation.md:39 SKILL.md:50-52 SKILL.md:52-88 SKILL.md:88-105 SKILL.md:105-122 SKILL.md:122-131 SKILL.md:131-137 SKILL.md:137-139 SKILL.md:139-140 SKILL.md:140-143 SKILL.md:143-150 SKILL.md:150-157 SKILL.md:157-162 SKILL.md:162-165 SKILL.md:165-171 SKILL.md:171-174 SKILL.md:174-182 SKILL.md:182-185 SKILL.md:185-191 SKILL.md:191-193 SKILL.md:193-201 SKILL.md:201-218 SKILL.md:218-225 SKILL.md:225-232 SKILL.md:232-242 SKILL.md:242-248 SKILL.md:248-251 SKILL.md:251-259 SKILL.md:259-264 SKILL.md:264-265 SKILL.md:265-266 SKILL.md:266-269 SKILL.md:269-270 SKILL.md:270-271 SKILL.md:271-272 SKILL.md:272-275 SKILL.md:275-276 SKILL.md:276-277 SKILL.md:277-278 SKILL.md:278-284 SKILL.md:284-300 SKILL.md:300-352 SKILL.md:352-372 SKILL.md:372-383 SKILL.md:383-386 SKILL.md:386-389 SKILL.md:389-392 SKILL.md:392-429 SKILL.md:429-438 SKILL.md:438-458

🌐 Network access (3)

references/installation.md:20 SKILL.md:132 SKILL.md:465

🔑 Env variables (5)

references/installation.md:59 references/installation.md:64 references/installation.md:71 SKILL.md:141 SKILL.md:142

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/davila7-paper-2-web/audits/14?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/davila7-paper-2-web/security.svg)](https://skillstore.io/skills/davila7-paper-2-web?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/davila7-paper-2-web?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/davila7-paper-2-web/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/davila7-paper-2-web.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

davila7. (2026). paper-2-web security audit report (audit version 14) [Author version unspecified]. Skillstore. https://skillstore.io/skills/davila7-paper-2-web/audits/14

BibTeX citation

@techreport{davila7-davila7-paper-2-web-2026,
  author = {davila7},
  title = {paper-2-web security audit report (audit version 14)},
  institution = {Skillstore},
  year = {2026},
  number = {14},
  url = {https://skillstore.io/skills/davila7-paper-2-web/audits/14},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "paper-2-web security audit report (audit version 14)"
version: "unspecified"
type: report
authors:
  - name: "davila7"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/davila7-paper-2-web/audits/14"
identifiers:
  - type: other
    value: "skillstore:davila7-paper-2-web:audit:14"
    description: "Skillstore immutable audit report identifier"

Compare variants

2 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Higher Skillstore usage

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

davila7 Recommended Current

davila7-paper-2-web

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 24

Updated

2026-08-21

K-Dense-AI

k-dense-ai-paper-2-web

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 9

Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Publish A Paper Homepage

Create a responsive web page that explains a paper, highlights results, and links to related materials.

Prepare Conference Materials

Generate a poster and video abstract from a paper before a symposium or poster session.

Promote Lab Publications

Batch plan consistent web, video, and poster assets for several papers from one research group.

Try These Prompts

Create A Website

Use this skill to plan a Paper2Web site for my paper. Review the input files and outline the needed setup steps.

Build Conference Assets

Use this skill to prepare a conference poster and short video abstract. Recommend inputs, dimensions, review checks, and likely dependencies.

Compare Output Options

Use this skill to compare website, poster, and video workflows for my deadline. Prioritize outputs by effort, cost, and review needs.

Plan Batch Processing

Use this skill to design a batch workflow for several papers. Include folder organization, model choices, manual review gates, and deployment steps.

Best Practices

Use clean LaTeX sources with all figures, tables, and bibliography files available.
Review generated text, figures, links, and citations before publishing any output.
Confirm API costs, dependency installation, and GPU needs before running large jobs.

Avoid

Do not publish generated scientific claims without expert review.
Do not paste real API keys into prompts, chat logs, or shared examples.
Do not run cloned pipeline code or elevated install commands without user approval.