📦
Audit History
paper-2-web - 10 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v10 Latest | Jul 9, 2026, 01:59 PM | 6 confirmed | 15 | No capability change |
| v9 | Jul 9, 2026, 01:59 PM | 6 confirmed | 15 | No capability change |
| v8 | Jul 5, 2026, 05:17 PM | 1 confirmed | 11 | No capability change |
| v7 | Jul 5, 2026, 05:17 PM | 1 confirmed | 11 | No capability change |
| v6 | Jun 30, 2026, 05:44 AM | 1 confirmed | 4 | No capability change |
| v5 | Jan 21, 2026, 05:35 PM | No confirmed findings | 0 | No capability change |
| v4 | Jan 17, 2026, 07:02 AM | No confirmed findings | 0 | No capability change |
| v3 | Jan 17, 2026, 07:02 AM | No confirmed findings | 0 | No capability change |
| v2 | Jan 12, 2026, 04:19 PM | No confirmed findings | 0 | External commandsNetwork accessEnv variables |
| v1 | Jan 4, 2026, 05:25 PM | No confirmed findings | 0 | Baseline |
Audit version 10 Latest
Jul 9, 2026, 01:59 PM
The skill is documentation-only, with no executable source files in the package. Confirmed risks are elevated installation commands, cloning third-party code, API key handling in .env files, and pipeline command examples that can call external model services. Most other static hits are false positives from markdown fences, directory trees, CLI option text, and quality metric prose; no prompt injection attempt was found.
6
Files scanned
1,917
Lines analyzed
24
Review items
0
False positives ignored
Confirmed security concerns (6)
High
Environment file access
Create a `.env` file in the project root with the following credentials:
The guide instructs users to create a .env file containing credentials. That is legitimate setup, but it requires clear secret-handling safeguards.
High
Environment file access
- Verify `.env` file is in the project root
The troubleshooting section asks users to verify the .env file location. This is operationally valid, but it confirms the workflow depends on a sensitive credential file.
High
Environment file access
- Ensure no extra spaces or quotes around keys in `.env`
The troubleshooting guidance discusses exact .env key formatting. This is legitimate, but it increases the need to warn users not to expose credential files.
High
Environment file access
├── .env # API credentials
The directory structure explicitly includes .env as API credentials. This is legitimate, but it documents a sensitive file that must not be committed or shared.
High
Environment file access
2. **Configure API Keys** (create `.env` file):
The quick start instructs users to create a .env file for API keys. This is legitimate setup, but it introduces sensitive file handling risk.
High
Environment file access
- Verify API keys in `.env` file
The troubleshooting section tells users to verify API keys in .env. This is legitimate support guidance, but it confirms the workflow depends on a sensitive file.
Capability review items (15)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
sudo privilege escalation
sudo apt-get install libreoffice poppler-utils
The installation guide instructs users to run sudo apt-get install for system packages. This is legitimate setup guidance, but it changes the host with elevated privileges and requires explicit user approval.
High
Generic API/secret keys · 2 occurrences
OPENAI_API_KEY=your_openai_api_key_here
The documentation requires an OPENAI_API_KEY in a .env file. This is normal configuration, but it introduces credential handling risk.
High
Generic API/secret keys
OPENROUTER_API_KEY=your_openrouter_api_key_here
The documentation supports OPENROUTER_API_KEY in a .env file. This is normal configuration, but it introduces credential handling risk.
High
Generic API/secret keys
GOOGLE_API_KEY=your_google_api_key_here
The optional Google Search API key is stored in .env for logo discovery. This is legitimate, but it still handles a sensitive credential.
High
Generic API/secret keys
# Optional: GOOGLE_API_KEY and GOOGLE_CSE_ID for logo search
The quick start mentions optional Google API credentials for logo search. These keys are sensitive and need explicit handling guidance.
Medium
SKILL.md:53-55SKILL.md:134-140SKILL.md:160-165SKILL.md:168-174SKILL.md:177-185SKILL.md:188-194SKILL.md:432-441
Ruby/shell backtick execution · 7 occurrences
```bash
The fenced bash example runs a Python script to generate a schematic. This is not Ruby backtick execution, but it is a real local command the agent might run.
Low
Hardcoded URL · 2 occurrences
git clone https://github.com/YuhangChen1/Paper2All.git
The guide tells users to clone an external GitHub repository. This is expected for setup, but it downloads third-party code into the user environment.
Risk Factors
⚙️ External commands (54)
references/installation.md:39 SKILL.md:53-55 SKILL.md:55-91 SKILL.md:91-108 SKILL.md:108-125 SKILL.md:125-134 SKILL.md:134-140 SKILL.md:140-142 SKILL.md:142-143 SKILL.md:143-146 SKILL.md:146-153 SKILL.md:153-160 SKILL.md:160-165 SKILL.md:165-168 SKILL.md:168-174 SKILL.md:174-177 SKILL.md:177-185 SKILL.md:185-188 SKILL.md:188-194 SKILL.md:194-196 SKILL.md:196-204 SKILL.md:204-221 SKILL.md:221-228 SKILL.md:228-235 SKILL.md:235-245 SKILL.md:245-251 SKILL.md:251-254 SKILL.md:254-262 SKILL.md:262-267 SKILL.md:267-268 SKILL.md:268-269 SKILL.md:269-272 SKILL.md:272-273 SKILL.md:273-274 SKILL.md:274-275 SKILL.md:275-278 SKILL.md:278-279 SKILL.md:279-280 SKILL.md:280-281 SKILL.md:281-287 SKILL.md:287-303 SKILL.md:303-355 SKILL.md:355-375 SKILL.md:375-386 SKILL.md:386-389 SKILL.md:389-392 SKILL.md:392-395 SKILL.md:395-432 SKILL.md:432-441 SKILL.md:441-461 SKILL.md:461-462 SKILL.md:462-463 SKILL.md:463-464 SKILL.md:464-465
🌐 Network access (3)
Audited by: codex
Jul 9, 2026, 01:59 PM
The skill is documentation-only, with no executable source files in the package. Confirmed risks are elevated installation commands, cloning third-party code, API key handling in .env files, and pipeline command examples that can call external model services. Most other static hits are false positives from markdown fences, directory trees, CLI option text, and quality metric prose; no prompt injection attempt was found.
6
Files scanned
1,917
Lines analyzed
24
Review items
0
False positives ignored
Confirmed security concerns (6)
High
Environment file access
Create a `.env` file in the project root with the following credentials:
The guide instructs users to create a .env file containing credentials. That is legitimate setup, but it requires clear secret-handling safeguards.
High
Environment file access
- Verify `.env` file is in the project root
The troubleshooting section asks users to verify the .env file location. This is operationally valid, but it confirms the workflow depends on a sensitive credential file.
High
Environment file access
- Ensure no extra spaces or quotes around keys in `.env`
The troubleshooting guidance discusses exact .env key formatting. This is legitimate, but it increases the need to warn users not to expose credential files.
High
Environment file access
├── .env # API credentials
The directory structure explicitly includes .env as API credentials. This is legitimate, but it documents a sensitive file that must not be committed or shared.
High
Environment file access
2. **Configure API Keys** (create `.env` file):
The quick start instructs users to create a .env file for API keys. This is legitimate setup, but it introduces sensitive file handling risk.
High
Environment file access
- Verify API keys in `.env` file
The troubleshooting section tells users to verify API keys in .env. This is legitimate support guidance, but it confirms the workflow depends on a sensitive file.
Capability review items (15)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
sudo privilege escalation
sudo apt-get install libreoffice poppler-utils
The installation guide instructs users to run sudo apt-get install for system packages. This is legitimate setup guidance, but it changes the host with elevated privileges and requires explicit user approval.
High
Generic API/secret keys · 2 occurrences
OPENAI_API_KEY=your_openai_api_key_here
The documentation requires an OPENAI_API_KEY in a .env file. This is normal configuration, but it introduces credential handling risk.
High
Generic API/secret keys
OPENROUTER_API_KEY=your_openrouter_api_key_here
The documentation supports OPENROUTER_API_KEY in a .env file. This is normal configuration, but it introduces credential handling risk.
High
Generic API/secret keys
GOOGLE_API_KEY=your_google_api_key_here
The optional Google Search API key is stored in .env for logo discovery. This is legitimate, but it still handles a sensitive credential.
High
Generic API/secret keys
# Optional: GOOGLE_API_KEY and GOOGLE_CSE_ID for logo search
The quick start mentions optional Google API credentials for logo search. These keys are sensitive and need explicit handling guidance.
Medium
SKILL.md:53-55SKILL.md:134-140SKILL.md:160-165SKILL.md:168-174SKILL.md:177-185SKILL.md:188-194SKILL.md:432-441
Ruby/shell backtick execution · 7 occurrences
```bash
The fenced bash example runs a Python script to generate a schematic. This is not Ruby backtick execution, but it is a real local command the agent might run.
Low
Hardcoded URL · 2 occurrences
git clone https://github.com/YuhangChen1/Paper2All.git
The guide tells users to clone an external GitHub repository. This is expected for setup, but it downloads third-party code into the user environment.
Risk Factors
⚙️ External commands (54)
references/installation.md:39 SKILL.md:53-55 SKILL.md:55-91 SKILL.md:91-108 SKILL.md:108-125 SKILL.md:125-134 SKILL.md:134-140 SKILL.md:140-142 SKILL.md:142-143 SKILL.md:143-146 SKILL.md:146-153 SKILL.md:153-160 SKILL.md:160-165 SKILL.md:165-168 SKILL.md:168-174 SKILL.md:174-177 SKILL.md:177-185 SKILL.md:185-188 SKILL.md:188-194 SKILL.md:194-196 SKILL.md:196-204 SKILL.md:204-221 SKILL.md:221-228 SKILL.md:228-235 SKILL.md:235-245 SKILL.md:245-251 SKILL.md:251-254 SKILL.md:254-262 SKILL.md:262-267 SKILL.md:267-268 SKILL.md:268-269 SKILL.md:269-272 SKILL.md:272-273 SKILL.md:273-274 SKILL.md:274-275 SKILL.md:275-278 SKILL.md:278-279 SKILL.md:279-280 SKILL.md:280-281 SKILL.md:281-287 SKILL.md:287-303 SKILL.md:303-355 SKILL.md:355-375 SKILL.md:375-386 SKILL.md:386-389 SKILL.md:389-392 SKILL.md:392-395 SKILL.md:395-432 SKILL.md:432-441 SKILL.md:441-461 SKILL.md:461-462 SKILL.md:462-463 SKILL.md:463-464 SKILL.md:464-465
🌐 Network access (3)
Audited by: codex
Jul 5, 2026, 05:17 PM
Most static findings are Markdown fences, placeholder API-key examples, or documentation text, and I marked those false positive. I confirmed the real risks from privileged package installation, cloning and running third-party pipeline commands, and network setup steps. I found no prompt injection claims, but the skill includes low-severity product steering for the creator's hosted service.
6
Files scanned
1,917
Lines analyzed
15
Review items
0
False positives ignored
Confirmed security concerns (1)
Low
Unrequested Third-Party Service Promotion
SKILL.md instructs the assistant to proactively suggest K-Dense Web, a hosted platform by the same creators, when workflows become complex. This can steer users toward an external service outside the requested paper transformation task.
The instruction is explicit and located in the skill guidance. It is product steering rather than malware, so severity is low.
Capability review items (11)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
sudo privilege escalation
sudo apt-get install libreoffice poppler-utils
The documentation instructs installing packages with sudo, which elevates privileges and can modify the host if executed by an agent. It is normal setup guidance, but it requires explicit user confirmation.
Medium
SKILL.md:53-55SKILL.md:134-140SKILL.md:160-165SKILL.md:168-174SKILL.md:177-185SKILL.md:188-194SKILL.md:432-441
Ruby/shell backtick execution · 7 occurrences
```bash
This section documents a Python command that runs a local schematic generation script with user-provided text. It is legitimate workflow guidance, but it is still external command execution.
Medium
Ruby/shell backtick execution
- Ensure LaTeX source compiles successfully: `pdflatex main.tex`
Troubleshooting recommends running pdflatex on local paper sources. This is common academic tooling, but compiling untrusted LaTeX can have side effects if unsafe options are enabled.
Low
Hardcoded URL · 2 occurrences
git clone https://github.com/YuhangChen1/Paper2All.git
The installation workflow clones a third-party GitHub repository, creating network and supply-chain risk if followed automatically. The URL is disclosed and relevant to the skill, so the risk remains low.
Risk Factors
⚙️ External commands (54)
references/installation.md:39 SKILL.md:53-55 SKILL.md:55-91 SKILL.md:91-108 SKILL.md:108-125 SKILL.md:125-134 SKILL.md:134-140 SKILL.md:140-142 SKILL.md:142-143 SKILL.md:143-146 SKILL.md:146-153 SKILL.md:153-160 SKILL.md:160-165 SKILL.md:165-168 SKILL.md:168-174 SKILL.md:174-177 SKILL.md:177-185 SKILL.md:185-188 SKILL.md:188-194 SKILL.md:194-196 SKILL.md:196-204 SKILL.md:204-221 SKILL.md:221-228 SKILL.md:228-235 SKILL.md:235-245 SKILL.md:245-251 SKILL.md:251-254 SKILL.md:254-262 SKILL.md:262-267 SKILL.md:267-268 SKILL.md:268-269 SKILL.md:269-272 SKILL.md:272-273 SKILL.md:273-274 SKILL.md:274-275 SKILL.md:275-278 SKILL.md:278-279 SKILL.md:279-280 SKILL.md:280-281 SKILL.md:281-287 SKILL.md:287-303 SKILL.md:303-355 SKILL.md:355-375 SKILL.md:375-386 SKILL.md:386-389 SKILL.md:389-392 SKILL.md:392-395 SKILL.md:395-432 SKILL.md:432-441 SKILL.md:441-461 SKILL.md:461-462 SKILL.md:462-463 SKILL.md:463-464 SKILL.md:464-465
🌐 Network access (3)
Audited by: codex
Jul 5, 2026, 05:17 PM
Most static findings are Markdown fences, placeholder API-key examples, or documentation text, and I marked those false positive. I confirmed the real risks from privileged package installation, cloning and running third-party pipeline commands, and network setup steps. I found no prompt injection claims, but the skill includes low-severity product steering for the creator's hosted service.
6
Files scanned
1,917
Lines analyzed
15
Review items
0
False positives ignored
Confirmed security concerns (1)
Low
Unrequested Third-Party Service Promotion
SKILL.md instructs the assistant to proactively suggest K-Dense Web, a hosted platform by the same creators, when workflows become complex. This can steer users toward an external service outside the requested paper transformation task.
The instruction is explicit and located in the skill guidance. It is product steering rather than malware, so severity is low.
Capability review items (11)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
sudo privilege escalation
sudo apt-get install libreoffice poppler-utils
The documentation instructs installing packages with sudo, which elevates privileges and can modify the host if executed by an agent. It is normal setup guidance, but it requires explicit user confirmation.
Medium
SKILL.md:53-55SKILL.md:134-140SKILL.md:160-165SKILL.md:168-174SKILL.md:177-185SKILL.md:188-194SKILL.md:432-441
Ruby/shell backtick execution · 7 occurrences
```bash
This section documents a Python command that runs a local schematic generation script with user-provided text. It is legitimate workflow guidance, but it is still external command execution.
Medium
Ruby/shell backtick execution
- Ensure LaTeX source compiles successfully: `pdflatex main.tex`
Troubleshooting recommends running pdflatex on local paper sources. This is common academic tooling, but compiling untrusted LaTeX can have side effects if unsafe options are enabled.
Low
Hardcoded URL · 2 occurrences
git clone https://github.com/YuhangChen1/Paper2All.git
The installation workflow clones a third-party GitHub repository, creating network and supply-chain risk if followed automatically. The URL is disclosed and relevant to the skill, so the risk remains low.
Risk Factors
⚙️ External commands (54)
references/installation.md:39 SKILL.md:53-55 SKILL.md:55-91 SKILL.md:91-108 SKILL.md:108-125 SKILL.md:125-134 SKILL.md:134-140 SKILL.md:140-142 SKILL.md:142-143 SKILL.md:143-146 SKILL.md:146-153 SKILL.md:153-160 SKILL.md:160-165 SKILL.md:165-168 SKILL.md:168-174 SKILL.md:174-177 SKILL.md:177-185 SKILL.md:185-188 SKILL.md:188-194 SKILL.md:194-196 SKILL.md:196-204 SKILL.md:204-221 SKILL.md:221-228 SKILL.md:228-235 SKILL.md:235-245 SKILL.md:245-251 SKILL.md:251-254 SKILL.md:254-262 SKILL.md:262-267 SKILL.md:267-268 SKILL.md:268-269 SKILL.md:269-272 SKILL.md:272-273 SKILL.md:273-274 SKILL.md:274-275 SKILL.md:275-278 SKILL.md:278-279 SKILL.md:279-280 SKILL.md:280-281 SKILL.md:281-287 SKILL.md:287-303 SKILL.md:303-355 SKILL.md:355-375 SKILL.md:375-386 SKILL.md:386-389 SKILL.md:389-392 SKILL.md:392-395 SKILL.md:395-432 SKILL.md:432-441 SKILL.md:441-461 SKILL.md:461-462 SKILL.md:462-463 SKILL.md:463-464 SKILL.md:464-465
🌐 Network access (3)
Audited by: codex
Jun 30, 2026, 05:44 AM
Static analysis flagged many command, network, and credential patterns. Review found these are mostly documentation examples for installing and running Paper2All, not confirmed malicious code, but the skill still carries medium risk because it directs Bash execution, external dependency installation, API key handling, optional web searches, and product promotion.
6
Files scanned
1,917
Lines analyzed
8
Review items
1
False positives ignored
Confirmed security concerns (1)
Medium
Creator Product Promotion Instruction
The skill tells the assistant to proactively suggest K-Dense Web for complex workflows. This is not a direct security exploit, but it is marketplace-relevant steering behavior that users may not expect from a task skill.
The instruction is explicit and appears in the main skill file. It does not override security review, but it can influence assistant recommendations for commercial promotion.
Capability review items (4)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
External Installation and Command Execution Guidance
The skill is allowed to use Bash and documents cloning an external repository, installing dependencies, and running Python pipelines. This appears legitimate for the stated workflow, but marketplace users should run it only after reviewing dependencies and isolating the environment.
The command examples are direct and numerous, including git, pip, conda, and sudo package installation. Context confirms they support the advertised Paper2All setup rather than hidden execution.
Medium
API Key and Environment File Handling
The installation guide instructs users to create a .env file with OpenAI, OpenRouter, and Google credentials. No evidence found that the skill exfiltrates secrets, but mishandling prompts or logs could expose credentials.
The referenced lines explicitly name API keys and .env usage. The content is standard configuration guidance, so the risk is credential exposure through handling, not confirmed theft.
Medium
Optional Network Search and Logo Download Workflow
The skill documents Google Search API use for automatic institution logo discovery and references external hosting and repository resources. This network use is disclosed and relevant, but it can contact external services and download assets.
The network behavior is stated in feature documentation and depends on user-enabled options. There is no evidence of covert endpoints or hidden data exfiltration.
Low
Reconnaissance Alerts Are Benign Troubleshooting Examples
The system reconnaissance alerts map to normal installation checks such as verifying LibreOffice, Poppler, GPU memory, or directory outputs. These checks are expected for media generation dependencies.
The reviewed lines are troubleshooting and quality documentation. They do not instruct broad host enumeration or network probing beyond dependency verification.
Static false positives ignored (1)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Low
references/paper2web.md:1-5references/paper2poster.md:1-5references/paper2video.md:1-5SKILL.md:10-20
Weak Cryptography Alerts Are False Positives
The static weak-cryptography hits occur in descriptive markdown about papers, posters, videos, quality metrics, or file examples. No evidence found of cryptographic algorithms, hashing code, or security-sensitive crypto use.
Manual review found explanatory text and workflow documentation at representative flagged locations. I did not find actual crypto code in the reviewed skill files.
Risk Factors
⚙️ External commands (4)
🌐 Network access (4)
🔑 Env variables (3)
Detected Patterns
Bash-Driven Workflow ExamplesCredential Configuration in .env
Audited by: codex
Jan 21, 2026, 05:35 PM
Documentation-only skill providing reference guides for the Paper2All academic paper transformation pipeline. Static findings are false positives triggered by documentation patterns (shell command examples, URL references, and API key placeholders). No executable code or malicious patterns present.
7
Files scanned
4,352
Lines analyzed
3
Review items
0
False positives ignored
Risk Factors
⚙️ External commands (6)
🌐 Network access (2)
🔑 Env variables (1)
Audited by: claude
Jan 17, 2026, 07:02 AM
AI analysis failed after multiple attempts - MANUAL REVIEW REQUIRED before publishing. This skill cannot be auto-published until reviewed by a human.
7
Files scanned
3,036
Lines analyzed
3
Review items
0
False positives ignored
Risk Factors
⚙️ External commands (164)
references/installation.md:19-22 references/installation.md:22-25 references/installation.md:25-28 references/installation.md:28-31 references/installation.md:31-33 references/installation.md:33-38 references/installation.md:38-40 references/installation.md:40-43 references/installation.md:43-45 references/installation.md:45-53 references/installation.md:53-58 references/installation.md:58-60 references/installation.md:60-63 references/installation.md:63-65 references/installation.md:65-70 references/installation.md:70-73 references/installation.md:73-88 references/installation.md:88 references/installation.md:88 references/installation.md:88-97 references/installation.md:97-99 references/installation.md:99-109 references/installation.md:109-112 references/installation.md:112-118 references/installation.md:118-121 references/installation.md:121-123 references/installation.md:123-129 references/installation.md:129-141 references/installation.md:39 references/paper2poster.md:34-40 references/paper2poster.md:40-44 references/paper2poster.md:44-52 references/paper2poster.md:52-57 references/paper2poster.md:57-58 references/paper2poster.md:58-59 references/paper2poster.md:59-60 references/paper2poster.md:60-63 references/paper2poster.md:63-64 references/paper2poster.md:64-65 references/paper2poster.md:65-66 references/paper2poster.md:66-69 references/paper2poster.md:69-70 references/paper2poster.md:70-71 references/paper2poster.md:71-72 references/paper2poster.md:72-85 references/paper2poster.md:85-87 references/paper2poster.md:87-93 references/paper2poster.md:93-119 references/paper2poster.md:119-135 references/paper2poster.md:135-217 references/paper2poster.md:217-225 references/paper2video.md:48-54 references/paper2video.md:54-58 references/paper2video.md:58-64 references/paper2video.md:64-69 references/paper2video.md:69-70 references/paper2video.md:70-71 references/paper2video.md:71-74 references/paper2video.md:74-75 references/paper2video.md:75 references/paper2video.md:75-76 references/paper2video.md:76-79 references/paper2video.md:79-80 references/paper2video.md:80-81 references/paper2video.md:81-82 references/paper2video.md:82-85 references/paper2video.md:85-86 references/paper2video.md:86-87 references/paper2video.md:87-92 references/paper2video.md:92-105 references/paper2video.md:105-121 references/paper2video.md:121-140 references/paper2web.md:33-38 references/paper2web.md:38-42 references/paper2web.md:42-43 references/paper2web.md:43-44 references/paper2web.md:44-45 references/paper2web.md:45-51 references/paper2web.md:51-61 references/paper2web.md:61-70 references/paper2web.md:70-76 references/paper2web.md:76-85 references/usage_examples.md:13-38 references/usage_examples.md:38-56 references/usage_examples.md:56-68 references/usage_examples.md:68-86 references/usage_examples.md:86-98 references/usage_examples.md:98-116 references/usage_examples.md:116-136 references/usage_examples.md:136-154 references/usage_examples.md:154-170 references/usage_examples.md:170-187 references/usage_examples.md:187-201 references/usage_examples.md:201-220 references/usage_examples.md:220-228 references/usage_examples.md:228-239 references/usage_examples.md:239-245 references/usage_examples.md:245-256 references/usage_examples.md:256-264 references/usage_examples.md:264-275 references/usage_examples.md:275-281 references/usage_examples.md:281-291 references/usage_examples.md:291-295 references/usage_examples.md:295-309 references/usage_examples.md:309-313 references/usage_examples.md:313-329 references/usage_examples.md:329-339 references/usage_examples.md:339-369 references/usage_examples.md:369-380 references/usage_examples.md:380-388 references/usage_examples.md:388-399 SKILL.md:53-55 SKILL.md:55-91 SKILL.md:91-108 SKILL.md:108-125 SKILL.md:125-134 SKILL.md:134-140 SKILL.md:140-142 SKILL.md:142-143 SKILL.md:143-146 SKILL.md:146-153 SKILL.md:153-160 SKILL.md:160-165 SKILL.md:165-168 SKILL.md:168-174 SKILL.md:174-177 SKILL.md:177-185 SKILL.md:185-188 SKILL.md:188-194 SKILL.md:194-196 SKILL.md:196-204 SKILL.md:204-221 SKILL.md:221-228 SKILL.md:228-235 SKILL.md:235-245 SKILL.md:245-251 SKILL.md:251-254 SKILL.md:254-262 SKILL.md:262-267 SKILL.md:267-268 SKILL.md:268-269 SKILL.md:269-272 SKILL.md:272-273 SKILL.md:273-274 SKILL.md:274-275 SKILL.md:275-278 SKILL.md:278-279 SKILL.md:279-280 SKILL.md:280-281 SKILL.md:281-287 SKILL.md:287-303 SKILL.md:303-355 SKILL.md:355-375 SKILL.md:375-386 SKILL.md:386-389 SKILL.md:389-392 SKILL.md:392-395 SKILL.md:395-432 SKILL.md:432-441 SKILL.md:441-461 SKILL.md:461-462 SKILL.md:462-463 SKILL.md:463-464 SKILL.md:464-465
🌐 Network access (5)
Detected Patterns
Ruby/shell backtick executionsudo privilege escalationHardcoded URLGeneric API/secret keysEnvironment file accessSystem reconnaissanceWeak cryptographic algorithmNetwork reconnaissance[HEURISTIC] DANGEROUS COMBINATION: Code execution + Network + Credential access
Audited by: claude
Jan 17, 2026, 07:02 AM
AI analysis failed after multiple attempts - MANUAL REVIEW REQUIRED before publishing. This skill cannot be auto-published until reviewed by a human.
7
Files scanned
3,036
Lines analyzed
3
Review items
0
False positives ignored
Risk Factors
⚙️ External commands (164)
references/installation.md:19-22 references/installation.md:22-25 references/installation.md:25-28 references/installation.md:28-31 references/installation.md:31-33 references/installation.md:33-38 references/installation.md:38-40 references/installation.md:40-43 references/installation.md:43-45 references/installation.md:45-53 references/installation.md:53-58 references/installation.md:58-60 references/installation.md:60-63 references/installation.md:63-65 references/installation.md:65-70 references/installation.md:70-73 references/installation.md:73-88 references/installation.md:88 references/installation.md:88 references/installation.md:88-97 references/installation.md:97-99 references/installation.md:99-109 references/installation.md:109-112 references/installation.md:112-118 references/installation.md:118-121 references/installation.md:121-123 references/installation.md:123-129 references/installation.md:129-141 references/installation.md:39 references/paper2poster.md:34-40 references/paper2poster.md:40-44 references/paper2poster.md:44-52 references/paper2poster.md:52-57 references/paper2poster.md:57-58 references/paper2poster.md:58-59 references/paper2poster.md:59-60 references/paper2poster.md:60-63 references/paper2poster.md:63-64 references/paper2poster.md:64-65 references/paper2poster.md:65-66 references/paper2poster.md:66-69 references/paper2poster.md:69-70 references/paper2poster.md:70-71 references/paper2poster.md:71-72 references/paper2poster.md:72-85 references/paper2poster.md:85-87 references/paper2poster.md:87-93 references/paper2poster.md:93-119 references/paper2poster.md:119-135 references/paper2poster.md:135-217 references/paper2poster.md:217-225 references/paper2video.md:48-54 references/paper2video.md:54-58 references/paper2video.md:58-64 references/paper2video.md:64-69 references/paper2video.md:69-70 references/paper2video.md:70-71 references/paper2video.md:71-74 references/paper2video.md:74-75 references/paper2video.md:75 references/paper2video.md:75-76 references/paper2video.md:76-79 references/paper2video.md:79-80 references/paper2video.md:80-81 references/paper2video.md:81-82 references/paper2video.md:82-85 references/paper2video.md:85-86 references/paper2video.md:86-87 references/paper2video.md:87-92 references/paper2video.md:92-105 references/paper2video.md:105-121 references/paper2video.md:121-140 references/paper2web.md:33-38 references/paper2web.md:38-42 references/paper2web.md:42-43 references/paper2web.md:43-44 references/paper2web.md:44-45 references/paper2web.md:45-51 references/paper2web.md:51-61 references/paper2web.md:61-70 references/paper2web.md:70-76 references/paper2web.md:76-85 references/usage_examples.md:13-38 references/usage_examples.md:38-56 references/usage_examples.md:56-68 references/usage_examples.md:68-86 references/usage_examples.md:86-98 references/usage_examples.md:98-116 references/usage_examples.md:116-136 references/usage_examples.md:136-154 references/usage_examples.md:154-170 references/usage_examples.md:170-187 references/usage_examples.md:187-201 references/usage_examples.md:201-220 references/usage_examples.md:220-228 references/usage_examples.md:228-239 references/usage_examples.md:239-245 references/usage_examples.md:245-256 references/usage_examples.md:256-264 references/usage_examples.md:264-275 references/usage_examples.md:275-281 references/usage_examples.md:281-291 references/usage_examples.md:291-295 references/usage_examples.md:295-309 references/usage_examples.md:309-313 references/usage_examples.md:313-329 references/usage_examples.md:329-339 references/usage_examples.md:339-369 references/usage_examples.md:369-380 references/usage_examples.md:380-388 references/usage_examples.md:388-399 SKILL.md:53-55 SKILL.md:55-91 SKILL.md:91-108 SKILL.md:108-125 SKILL.md:125-134 SKILL.md:134-140 SKILL.md:140-142 SKILL.md:142-143 SKILL.md:143-146 SKILL.md:146-153 SKILL.md:153-160 SKILL.md:160-165 SKILL.md:165-168 SKILL.md:168-174 SKILL.md:174-177 SKILL.md:177-185 SKILL.md:185-188 SKILL.md:188-194 SKILL.md:194-196 SKILL.md:196-204 SKILL.md:204-221 SKILL.md:221-228 SKILL.md:228-235 SKILL.md:235-245 SKILL.md:245-251 SKILL.md:251-254 SKILL.md:254-262 SKILL.md:262-267 SKILL.md:267-268 SKILL.md:268-269 SKILL.md:269-272 SKILL.md:272-273 SKILL.md:273-274 SKILL.md:274-275 SKILL.md:275-278 SKILL.md:278-279 SKILL.md:279-280 SKILL.md:280-281 SKILL.md:281-287 SKILL.md:287-303 SKILL.md:303-355 SKILL.md:355-375 SKILL.md:375-386 SKILL.md:386-389 SKILL.md:389-392 SKILL.md:392-395 SKILL.md:395-432 SKILL.md:432-441 SKILL.md:441-461 SKILL.md:461-462 SKILL.md:462-463 SKILL.md:463-464 SKILL.md:464-465
🌐 Network access (5)
Detected Patterns
Ruby/shell backtick executionsudo privilege escalationHardcoded URLGeneric API/secret keysEnvironment file accessSystem reconnaissanceWeak cryptographic algorithmNetwork reconnaissance[HEURISTIC] DANGEROUS COMBINATION: Code execution + Network + Credential access
Audited by: claude
Jan 12, 2026, 04:19 PM
This repository contains ONLY markdown documentation files. All 262 static findings are FALSE POSITIVES. The analyzer misidentified markdown code fences as Ruby backticks, documentation examples as command execution, and placeholder text as actual secrets. No executable code exists in this repository.
6
Files scanned
1,917
Lines analyzed
3
Review items
0
False positives ignored
Risk Factors
⚙️ External commands (164)
references/installation.md:19-22 references/installation.md:22-25 references/installation.md:25-28 references/installation.md:28-31 references/installation.md:31-33 references/installation.md:33-38 references/installation.md:38-40 references/installation.md:40-43 references/installation.md:43-45 references/installation.md:45-53 references/installation.md:53-58 references/installation.md:58-60 references/installation.md:60-63 references/installation.md:63-65 references/installation.md:65-70 references/installation.md:70-73 references/installation.md:73-88 references/installation.md:88 references/installation.md:88 references/installation.md:88-97 references/installation.md:97-99 references/installation.md:99-109 references/installation.md:109-112 references/installation.md:112-118 references/installation.md:118-121 references/installation.md:121-123 references/installation.md:123-129 references/installation.md:129-141 references/installation.md:39 references/paper2poster.md:34-40 references/paper2poster.md:40-44 references/paper2poster.md:44-52 references/paper2poster.md:52-57 references/paper2poster.md:57-58 references/paper2poster.md:58-59 references/paper2poster.md:59-60 references/paper2poster.md:60-63 references/paper2poster.md:63-64 references/paper2poster.md:64-65 references/paper2poster.md:65-66 references/paper2poster.md:66-69 references/paper2poster.md:69-70 references/paper2poster.md:70-71 references/paper2poster.md:71-72 references/paper2poster.md:72-85 references/paper2poster.md:85-87 references/paper2poster.md:87-93 references/paper2poster.md:93-119 references/paper2poster.md:119-135 references/paper2poster.md:135-217 references/paper2poster.md:217-225 references/paper2video.md:48-54 references/paper2video.md:54-58 references/paper2video.md:58-64 references/paper2video.md:64-69 references/paper2video.md:69-70 references/paper2video.md:70-71 references/paper2video.md:71-74 references/paper2video.md:74-75 references/paper2video.md:75 references/paper2video.md:75-76 references/paper2video.md:76-79 references/paper2video.md:79-80 references/paper2video.md:80-81 references/paper2video.md:81-82 references/paper2video.md:82-85 references/paper2video.md:85-86 references/paper2video.md:86-87 references/paper2video.md:87-92 references/paper2video.md:92-105 references/paper2video.md:105-121 references/paper2video.md:121-140 references/paper2web.md:33-38 references/paper2web.md:38-42 references/paper2web.md:42-43 references/paper2web.md:43-44 references/paper2web.md:44-45 references/paper2web.md:45-51 references/paper2web.md:51-61 references/paper2web.md:61-70 references/paper2web.md:70-76 references/paper2web.md:76-85 references/usage_examples.md:13-38 references/usage_examples.md:38-56 references/usage_examples.md:56-68 references/usage_examples.md:68-86 references/usage_examples.md:86-98 references/usage_examples.md:98-116 references/usage_examples.md:116-136 references/usage_examples.md:136-154 references/usage_examples.md:154-170 references/usage_examples.md:170-187 references/usage_examples.md:187-201 references/usage_examples.md:201-220 references/usage_examples.md:220-228 references/usage_examples.md:228-239 references/usage_examples.md:239-245 references/usage_examples.md:245-256 references/usage_examples.md:256-264 references/usage_examples.md:264-275 references/usage_examples.md:275-281 references/usage_examples.md:281-291 references/usage_examples.md:291-295 references/usage_examples.md:295-309 references/usage_examples.md:309-313 references/usage_examples.md:313-329 references/usage_examples.md:329-339 references/usage_examples.md:339-369 references/usage_examples.md:369-380 references/usage_examples.md:380-388 references/usage_examples.md:388-399 SKILL.md:53-55 SKILL.md:55-91 SKILL.md:91-108 SKILL.md:108-125 SKILL.md:125-134 SKILL.md:134-140 SKILL.md:140-142 SKILL.md:142-143 SKILL.md:143-146 SKILL.md:146-153 SKILL.md:153-160 SKILL.md:160-165 SKILL.md:165-168 SKILL.md:168-174 SKILL.md:174-177 SKILL.md:177-185 SKILL.md:185-188 SKILL.md:188-194 SKILL.md:194-196 SKILL.md:196-204 SKILL.md:204-221 SKILL.md:221-228 SKILL.md:228-235 SKILL.md:235-245 SKILL.md:245-251 SKILL.md:251-254 SKILL.md:254-262 SKILL.md:262-267 SKILL.md:267-268 SKILL.md:268-269 SKILL.md:269-272 SKILL.md:272-273 SKILL.md:273-274 SKILL.md:274-275 SKILL.md:275-278 SKILL.md:278-279 SKILL.md:279-280 SKILL.md:280-281 SKILL.md:281-287 SKILL.md:287-303 SKILL.md:303-355 SKILL.md:355-375 SKILL.md:375-386 SKILL.md:386-389 SKILL.md:389-392 SKILL.md:392-395 SKILL.md:395-432 SKILL.md:432-441 SKILL.md:441-461 SKILL.md:461-462 SKILL.md:462-463 SKILL.md:463-464 SKILL.md:464-465
🌐 Network access (5)
Audited by: claude
Jan 4, 2026, 05:25 PM
This skill contains only documentation files with no executable code. It serves as a wrapper for the external Paper2All tool, providing guidance for users to manually install and run the tool. No file system access, network calls, or code execution capabilities exist within the skill itself.
8
Files scanned
2,157
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude