Skills paper-2-web
📦
paper-2-web
Content revision r1 High Risk ⚙️ External commands🌐 Network access🔑 Env variables
Transform Papers Into Web, Video, and Posters
Researchers often need paper websites, posters, and video abstracts under deadline. This skill guides Paper2All workflows that turn LaTeX or PDF papers into research promotion assets.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "paper-2-web" from https://skillstore.io/skills/k-dense-ai-paper-2-web.md and its manifest at https://skillstore.io/api/skills/k-dense-ai-paper-2-web/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "paper-2-web". A LaTeX paper with figures, tables, and bibliography needs a public project page.
Expected outcome:
- A website generation plan with input checks and output folders.
- A review checklist for figures, links, mobile layout, and accessibility.
- Deployment guidance for GitHub Pages, lab hosting, or a personal server.
Using "paper-2-web". A researcher needs a 48 by 36 inch conference poster for a poster session.
Expected outcome:
- A poster workflow with size, section priority, branding, and QR code guidance.
- A print readiness checklist for resolution, fonts, colors, bleed, and test prints.
Using "paper-2-web". A journal submission needs a short video abstract for general readers.
Expected outcome:
- A video plan with slide count, narration style, duration, and subtitle review.
- Quality checks for factual accuracy, audio clarity, timing, and final encoding.
Security Audit
High Riskv10 • 7/9/2026 Open versioned report
The skill is documentation-only, with no executable source files in the package. Confirmed risks are elevated installation commands, cloning third-party code, API key handling in .env files, and pipeline command examples that can call external model services. Most other static hits are false positives from markdown fences, directory trees, CLI option text, and quality metric prose; no prompt injection attempt was found.
6
Files scanned
1,917
Lines analyzed
15
Review items
0
False positives ignored
Confirmed security concerns (6)
High
Environment file access
Create a `.env` file in the project root with the following credentials:
The guide instructs users to create a .env file containing credentials. That is legitimate setup, but it requires clear secret-handling safeguards.
High
Environment file access
- Verify `.env` file is in the project root
The troubleshooting section asks users to verify the .env file location. This is operationally valid, but it confirms the workflow depends on a sensitive credential file.
High
Environment file access
- Ensure no extra spaces or quotes around keys in `.env`
The troubleshooting guidance discusses exact .env key formatting. This is legitimate, but it increases the need to warn users not to expose credential files.
High
Environment file access
├── .env # API credentials
The directory structure explicitly includes .env as API credentials. This is legitimate, but it documents a sensitive file that must not be committed or shared.
High
Environment file access
2. **Configure API Keys** (create `.env` file):
The quick start instructs users to create a .env file for API keys. This is legitimate setup, but it introduces sensitive file handling risk.
High
Environment file access
- Verify API keys in `.env` file
The troubleshooting section tells users to verify API keys in .env. This is legitimate support guidance, but it confirms the workflow depends on a sensitive file.
Capability review items (15)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
sudo privilege escalation
sudo apt-get install libreoffice poppler-utils
The installation guide instructs users to run sudo apt-get install for system packages. This is legitimate setup guidance, but it changes the host with elevated privileges and requires explicit user approval.
High
Generic API/secret keys
OPENAI_API_KEY=your_openai_api_key_here
The documentation requires an OPENAI_API_KEY in a .env file. This is normal configuration, but it introduces credential handling risk.
High
Generic API/secret keys
OPENROUTER_API_KEY=your_openrouter_api_key_here
The documentation supports OPENROUTER_API_KEY in a .env file. This is normal configuration, but it introduces credential handling risk.
High
Generic API/secret keys
GOOGLE_API_KEY=your_google_api_key_here
The optional Google Search API key is stored in .env for logo discovery. This is legitimate, but it still handles a sensitive credential.
High
Generic API/secret keys
OPENAI_API_KEY=your_openai_api_key_here
The quick start asks users to place OPENAI_API_KEY in a .env file. This is legitimate configuration, but it is sensitive credential handling.
High
Generic API/secret keys
# Optional: GOOGLE_API_KEY and GOOGLE_CSE_ID for logo search
The quick start mentions optional Google API credentials for logo search. These keys are sensitive and need explicit handling guidance.
Medium
Ruby/shell backtick execution
```bash
The fenced bash example runs a Python script to generate a schematic. This is not Ruby backtick execution, but it is a real local command the agent might run.
Medium
Ruby/shell backtick execution
```bash
The quick start includes git clone, conda setup, and pip install commands for an external project. The markdown pattern is noisy, but the block contains real setup commands.
Medium
Ruby/shell backtick execution
```bash
The example runs pipeline_all.py with user-provided input and output directories. This is expected behavior, but it executes local pipeline code and can use API credentials.
Medium
Ruby/shell backtick execution
```bash
The example runs pipeline_all.py to generate a website. This is expected behavior, but it executes local pipeline code and can call external model services.
Medium
Ruby/shell backtick execution
```bash
The example runs pipeline_all.py to generate a poster with custom dimensions. This is expected behavior, but it executes local pipeline code against user files.
Medium
Ruby/shell backtick execution
```bash
The example runs pipeline_light.py for video generation. This is expected behavior, but it executes local pipeline code and can use external model APIs.
Medium
Ruby/shell backtick execution
```bash
The batch-processing example runs multiple pipeline_all.py commands in a shell loop. This is legitimate, but it can trigger repeated local execution and API usage.
Low
Hardcoded URL
git clone https://github.com/YuhangChen1/Paper2All.git
The guide tells users to clone an external GitHub repository. This is expected for setup, but it downloads third-party code into the user environment.
Low
Hardcoded URL
git clone https://github.com/YuhangChen1/Paper2All.git
The quick start tells users to clone a third-party GitHub repository. This is expected setup, but it downloads external code before execution.
Risk Factors
⚙️ External commands (54)
references/installation.md:39 SKILL.md:53-55 SKILL.md:55-91 SKILL.md:91-108 SKILL.md:108-125 SKILL.md:125-134 SKILL.md:134-140 SKILL.md:140-142 SKILL.md:142-143 SKILL.md:143-146 SKILL.md:146-153 SKILL.md:153-160 SKILL.md:160-165 SKILL.md:165-168 SKILL.md:168-174 SKILL.md:174-177 SKILL.md:177-185 SKILL.md:185-188 SKILL.md:188-194 SKILL.md:194-196 SKILL.md:196-204 SKILL.md:204-221 SKILL.md:221-228 SKILL.md:228-235 SKILL.md:235-245 SKILL.md:245-251 SKILL.md:251-254 SKILL.md:254-262 SKILL.md:262-267 SKILL.md:267-268 SKILL.md:268-269 SKILL.md:269-272 SKILL.md:272-273 SKILL.md:273-274 SKILL.md:274-275 SKILL.md:275-278 SKILL.md:278-279 SKILL.md:279-280 SKILL.md:280-281 SKILL.md:281-287 SKILL.md:287-303 SKILL.md:303-355 SKILL.md:355-375 SKILL.md:375-386 SKILL.md:386-389 SKILL.md:389-392 SKILL.md:392-395 SKILL.md:395-432 SKILL.md:432-441 SKILL.md:441-461 SKILL.md:461-462 SKILL.md:462-463 SKILL.md:463-464 SKILL.md:464-465
🌐 Network access (3)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/k-dense-ai-paper-2-web/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/k-dense-ai-paper-2-web?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/k-dense-ai-paper-2-web?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/k-dense-ai-paper-2-web/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/k-dense-ai-paper-2-web.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
K-Dense-AI. (2026). paper-2-web security audit report (audit version 10) [Author version unspecified]. Skillstore. https://skillstore.io/skills/k-dense-ai-paper-2-web/audits/10BibTeX citation
@techreport{k-dense-ai-k-dense-ai-paper-2-web-2026,
author = {K-Dense-AI},
title = {paper-2-web security audit report (audit version 10)},
institution = {Skillstore},
year = {2026},
number = {10},
url = {https://skillstore.io/skills/k-dense-ai-paper-2-web/audits/10},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "paper-2-web security audit report (audit version 10)"
version: "unspecified"
type: report
authors:
- name: "K-Dense-AI"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/k-dense-ai-paper-2-web/audits/10"
identifiers:
- type: other
value: "skillstore:k-dense-ai-paper-2-web:audit:10"
description: "Skillstore immutable audit report identifier"
Compare variants
2 installable variantsEach author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.
Why this variant is first
Higher Skillstore usage
Author / source Skillstore Score Evidence Confidence Skillstore usage Updated
davila7 Recommended
davila7-paper-2-web
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 24
Updated
2026-08-21
K-Dense-AI Current
k-dense-ai-paper-2-web
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 9
Updated
2026-08-21
Skillstore Score
Why this score Evidence Confidence: Medium 45
Architecture
75
Maintainability
87
Content
71
Community
83
Spec Compliance
What You Can Build
Prepare Conference Materials
Create a coordinated website, poster, and presentation video for a paper submission or accepted talk.
Publish Paper Homepages
Turn a LaTeX or PDF paper into an explorable web page for a lab site or preprint page.
Create Video Abstracts
Generate a short narrated presentation that summarizes findings for journals, courses, or social media.
Try These Prompts
Create A Paper Website
Convert my paper into an interactive website. Review the input files, suggest the best setup, and list what I should verify before publishing.
Generate A Conference Poster
Create a conference poster plan for my paper. Use the required poster size, highlight key findings, and include a print review checklist.
Build A Full Package
Prepare a complete research promotion package with website, poster, and video. Recommend the processing order, model settings, and review steps.
Plan Batch Conversion
Plan a batch workflow for multiple papers. Define folder organization, output naming, cost controls, and review gates for each generated asset.
Best Practices
- Start from clean LaTeX with complete figures, tables, and bibliography files.
- Review every generated claim, citation, image, and narration before publication.
- Ask for confirmation before running install commands, pipeline scripts, or external API features.
Avoid
- Running sudo setup commands without checking the package source and platform requirements.
- Publishing generated websites, posters, or videos without expert review.
- Putting real API keys in shared prompts, documentation, screenshots, or repositories.
Frequently Asked Questions
What input formats does this skill support?
It supports LaTeX source directories and high-quality PDFs. LaTeX gives the best structure and asset extraction.
Does this skill include the Paper2All code?
No. It provides guidance for using the external Paper2All repository and its documented workflows.
Which outputs can it help create?
It can guide creation of academic websites, conference posters, presentation videos, and combined dissemination packages.
Are API keys required?
Yes, LLM-backed generation requires API keys. Google keys are optional for automatic logo discovery.
Can it handle multiple papers?
Yes. The documentation includes batch organization and multi-paper workflow guidance.
Should outputs be reviewed before sharing?
Yes. Users should review factual accuracy, citations, visual quality, accessibility, and printing requirements.
Developer Details
Author
K-Dense-AILicense
Unknown
Skillstore revision
r1
Version notice
The author did not declare a version.
Repository
https://github.com/K-Dense-AI/claude-scientific-skills/tree/main/scientific-skills/paper-2-webRef
26421118b848d9f1efc0aa169d8a7a9e7e0a877e
Maintenance freshness
7/21/2026
Usage
7 downloads · 259 views
File structure