📦
latex-posters
87创建 LaTeX 科研海报
科研海报在 LaTeX 中很难排版，也很难为印刷进行校对。此技能提供模板、布局指导和 PDF 检查，帮助制作符合会议要求的海报。
设计与创意 查看
技能 paper-2-web
📦
paper-2-web
内容修订 r1 高风险 ⚙️ 外部命令🌐 网络访问🔑 环境变量
将论文转化为研究网站和媒体素材
学术论文很难在静态 PDF 之外进行分享。此技能会指导 Paper2All 工作流，从 LaTeX 或 PDF 输入生成网站、海报和视频。
支持: Claude Codex Code(CC)
安装前请停下并请求确认。
请审查安装计划，并在更改文件前获得用户明确同意。
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "paper-2-web" from https://skillstore.io/skills/davila7-paper-2-web.md and its manifest at https://skillstore.io/api/skills/davila7-paper-2-web/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“paper-2-web”。 一位研究人员希望从 LaTeX 论文生成交互式主页。
预期结果:
- 包含所需输入文件和输出文件夹的 Paper2Web 工作流。
- 涵盖摘要、方法、结果、图表、引用和作者详情的网站计划。
- 用于响应式布局、链接可用性和图表质量的审查清单。
正在使用“paper-2-web”。 一位会议演讲者需要海报和短视频。
预期结果:
- 涵盖海报尺寸、视觉层级、旁白时长和品牌化的制作计划。
- 生成前所需资产列表，包括图表和 bibliography 文件。
- 针对打印可读性、音频同步和科学准确性的审查步骤。
正在使用“paper-2-web”。 一个实验室希望为多篇已接收论文制作传播资产。
预期结果:
- 每篇论文一个输出文件夹的批量处理方法。
- 先创建网站、再创建海报、最后创建视频的优先顺序。
- 针对内容准确性、品牌化和发布就绪状态的最终审查清单。
安全审计
高风险v14 • 2026/7/9 打开版本化报告
The skill has legitimate research-transformation intent, and I found no prompt injection attempt. Risks remain from third-party pipeline execution, sudo package installation, API keys, and external LLM or search services.
6
已扫描文件
1,912
分析行数
15
复核项
0
已忽略误报
已确认安全问题 (9)
高
Environment file access
Create a `.env` file in the project root with the following credentials:
The guide instructs users to create a .env file containing credentials. That is legitimate setup, but the skill should treat the file as sensitive and prevent accidental disclosure.
高
Environment file access
- Verify `.env` file is in the project root
The troubleshooting section explicitly checks for the .env file in the project root. This confirms the workflow depends on local secret files and should include secret hygiene controls.
高
Environment file access
- Ensure no extra spaces or quotes around keys in `.env`
The guide gives formatting advice for keys in the .env file. This is safe operational guidance, but it still handles secrets that can be leaked through prompts, logs, or committed files.
高
Environment file access
├── .env # API credentials
The documented project tree includes .env as the location for API credentials. This is a real sensitive-file pattern and needs warnings about version control and generated artifacts.
高
Environment file access
2. **Configure API Keys** (create `.env` file):
The skill tells users to create a .env file for API keys. The usage is legitimate, but it introduces sensitive-file handling in the project workspace.
高
Environment file access
- Verify API keys in `.env` file
The troubleshooting section instructs users to verify API keys in the .env file. This confirms the workflow accesses local secrets and should avoid exposing them in chat or output.
高
Unverified Third-Party Pipeline Installation
The skill directs users to clone Paper2All from GitHub and install requirements without a pinned commit, checksum, or dependency lock guidance.
The cited setup steps combine external repository cloning with dependency installation. The documentation does not provide integrity verification or pinning guidance.
中
Private Manuscript Data May Reach Third-Party LLMs
The workflow uses LLM-powered content extraction and supports OpenAI, OpenRouter, and Claude-backed model providers, which may process paper content.
The files explicitly describe LLM-powered processing and third-party model backends. This creates a privacy risk for unpublished or confidential manuscripts.
显示全部 9 条已确认问题
中
External Logo Search Downloads Third-Party Assets
The optional logo discovery feature uses Google Search API to find, download, and integrate institution logos into generated outputs.
The cited documentation states that the feature searches for official logos and downloads logo images. This creates network, attribution, and untrusted asset handling concerns.
能力复核项 (15)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
高
sudo privilege escalation
sudo apt-get install libreoffice poppler-utils
The installation guide instructs users to run sudo apt-get install, which modifies system packages with elevated privileges. This is legitimate dependency setup, but it still requires explicit trust and user confirmation.
高
Generic API/secret keys
OPENAI_API_KEY=your_openai_api_key_here
The documentation asks users to place an OpenAI API key in a project .env file. This is a real secret-handling risk because the external pipeline will read credentials from the workspace.
高
Generic API/secret keys
OPENROUTER_API_KEY=your_openrouter_api_key_here
The documentation asks users to place an OpenRouter API key in a project .env file. This is sensitive credential handling and needs clear storage and sharing safeguards.
高
Generic API/secret keys
GOOGLE_API_KEY=your_google_api_key_here
The documentation asks users to place a Google API key in a project .env file for logo search. This exposes a real API credential to local tooling and generated workflows.
高
Ruby/shell backtick execution
```bash
The quick start block clones an external repository, creates an environment, and installs dependencies. Running unpinned third-party code and packages is a real supply-chain risk.
高
Generic API/secret keys
OPENAI_API_KEY=your_openai_api_key_here
The quick start asks users to place an OpenAI API key in a .env file. This is a genuine credential-handling risk in a community skill that runs external tooling.
高
Generic API/secret keys
# Optional: GOOGLE_API_KEY and GOOGLE_CSE_ID for logo search
The quick start references Google API credentials for logo search. Optional credentials are still sensitive and need protection from logs, prompts, and generated files.
中
Ruby/shell backtick execution
```bash
The cited bash block directs execution of a Python schematic-generation script. It is a documented workflow, but it still asks the agent or user to run local code.
中
Ruby/shell backtick execution
```bash
The usage block instructs running pipeline_all.py with user-selected input and output paths. This is intended behavior, but it executes local pipeline code on user documents.
中
Ruby/shell backtick execution
```bash
The website-only example runs pipeline_all.py from the external Paper2All project. This is legitimate usage, but it is still external command execution over local paper files.
中
Ruby/shell backtick execution
```bash
The poster example runs pipeline_all.py with output and poster sizing arguments. The command is documented, but it executes local pipeline code and should require confirmation.
中
Ruby/shell backtick execution
```bash
The video example runs pipeline_light.py with model and paper paths. This is a real command execution path, including possible API calls and heavy local processing.
中
Ruby/shell backtick execution
```bash
The batch example runs pipeline_all.py repeatedly in a shell loop. It is an intended workflow, but it can launch multiple external processes, API calls, and filesystem writes.
低
Hardcoded URL
git clone https://github.com/YuhangChen1/Paper2All.git
The guide directs users to clone a fixed external GitHub repository. That network dependency is expected, but it creates supply-chain exposure if the repository changes or is compromised.
低
Hardcoded URL
git clone https://github.com/YuhangChen1/Paper2All.git
The quick start directs cloning a fixed external GitHub repository. This is expected setup, but it is still a network dependency with supply-chain risk.
风险因素
⚙️ 外部命令 (50)
references/installation.md:39 SKILL.md:50-52 SKILL.md:52-88 SKILL.md:88-105 SKILL.md:105-122 SKILL.md:122-131 SKILL.md:131-137 SKILL.md:137-139 SKILL.md:139-140 SKILL.md:140-143 SKILL.md:143-150 SKILL.md:150-157 SKILL.md:157-162 SKILL.md:162-165 SKILL.md:165-171 SKILL.md:171-174 SKILL.md:174-182 SKILL.md:182-185 SKILL.md:185-191 SKILL.md:191-193 SKILL.md:193-201 SKILL.md:201-218 SKILL.md:218-225 SKILL.md:225-232 SKILL.md:232-242 SKILL.md:242-248 SKILL.md:248-251 SKILL.md:251-259 SKILL.md:259-264 SKILL.md:264-265 SKILL.md:265-266 SKILL.md:266-269 SKILL.md:269-270 SKILL.md:270-271 SKILL.md:271-272 SKILL.md:272-275 SKILL.md:275-276 SKILL.md:276-277 SKILL.md:277-278 SKILL.md:278-284 SKILL.md:284-300 SKILL.md:300-352 SKILL.md:352-372 SKILL.md:372-383 SKILL.md:383-386 SKILL.md:386-389 SKILL.md:389-392 SKILL.md:392-429 SKILL.md:429-438 SKILL.md:438-458
审计者: codex 查看审计历史 →
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/davila7-paper-2-web/audits/14?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/davila7-paper-2-web?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/davila7-paper-2-web?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/davila7-paper-2-web/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/davila7-paper-2-web.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
davila7. (2026). paper-2-web security audit report (audit version 14) [Author version unspecified]. Skillstore. https://skillstore.io/skills/davila7-paper-2-web/audits/14BibTeX 引用
@techreport{davila7-davila7-paper-2-web-2026,
author = {davila7},
title = {paper-2-web security audit report (audit version 14)},
institution = {Skillstore},
year = {2026},
number = {14},
url = {https://skillstore.io/skills/davila7-paper-2-web/audits/14},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "paper-2-web security audit report (audit version 14)"
version: "unspecified"
type: report
authors:
- name: "davila7"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/davila7-paper-2-web/audits/14"
identifiers:
- type: other
value: "skillstore:davila7-paper-2-web:audit:14"
description: "Skillstore immutable audit report identifier"
比较变体
2 个可安装变体每位作者的技能都保持为独立的可安装项。推荐变体按 Skillstore 证据排序。
为什么此变体排名第一
Skillstore 使用量更高
作者 / 来源 Skillstore 评分 证据置信度 Skillstore 使用量 已更新
Skillstore 评分
评分依据 证据置信度: 中 45
架构
85
可维护性
87
内容
70
社区
83
规范符合性
你能构建什么
创建论文主页
将已完成的论文转化为包含图表、结果、引用和作者信息的响应式网站。
准备会议材料
为会议投稿生成海报、短视频摘要和配套网站。
发布实验室研究资产
为同一实验室或项目组的多篇论文规划风格一致的网站、海报和视频。
试试这些提示
创建网站
使用 paper-2-web 将我的论文文件夹转化为交互式研究网站。在运行命令之前，先询问任何缺失的输入。
规划会议资产
使用 paper-2-web 为我的会议论文规划网站、海报和短视频。包括所需输入和审查步骤。
审查生成就绪情况
使用 paper-2-web 检查我的 LaTeX 或 PDF 源文件是否已准备好用于 Paper2All 生成。报告缺失文件和风险。
运行批量工作流
使用 paper-2-web 为多篇论文设计批量工作流。优先生成网站，其次是海报，再次是视频，并为每个输出设置 QA。
最佳实践
- 使用干净的 LaTeX 源文件，并包含完整的图表、表格和 bibliography 文件。
- 发布前审查生成的声明、引用、链接、可访问性和图表质量。
- 将 API keys 放在版本控制之外，并在隔离环境中运行生成流程。
避免
- 在没有隔离或确认的情况下，在生产环境中运行安装命令。
- 未检查科学准确性和作者批准就发布生成材料。
- 在未验证许可、来源和下载资产的情况下启用外部 logo 搜索。
常见问题
这个技能会自行生成网站吗？
它会指导 Paper2All 工作流，并可运行已批准的命令。外部 Paper2All 项目负责执行生成。
哪些输入效果最好？
包含图表、表格和 bibliography 的干净 LaTeX 效果最好。高质量 PDF 也可以使用。
需要 API keys 吗？
大多数由 LLM 驱动的生成都需要 OpenAI、OpenRouter 或 Google API keys。请安全存储 keys，避免提交它们。
它也能创建海报和视频吗？
可以。此技能涵盖从同一研究源生成 Paper2Web、Paper2Poster 和 Paper2Video 的工作流。
我可以只使用 PDF 吗？
可以，但可选择文本和高分辨率图表会提升提取质量。LaTeX 通常能提供更好的结构。
我应该采取哪些安全预防措施？
使用隔离环境，在执行前审查命令，固定可信来源，并保护 .env 文件。
开发者详情
作者
davila7许可证
MIT
Skillstore 修订
r1
版本提示
作者未声明版本。
引用
b959ebfd1043a07c0c4378ab94ca4342cb0259f5
维护新鲜度
2026/7/20
使用量
18 次下载 · 233 次浏览
文件结构
davila7 的更多技能
查看全部📦
content-creator
87创建适合 SEO 的营销内容
营销团队需要清晰的内容，以匹配品牌语调和搜索目标。此技能提供模板、分析脚本和平台指南，用于可重复的内容生产。
写作与内容 查看
📦
treatment-plans
86创建结构化医疗治疗计划
临床治疗计划往往会变得不一致、冗长或难以审查。此技能提供重点明确的模板、可衡量的目标、时间表和本地质量检查。
文档 查看
📦
clinical-reports
86创建结构化临床报告
临床团队需要符合医疗和监管标准的清晰报告。此技能为病例报告、诊断、试验和患者记录提供模板、检查清单和验证指导。
文档 查看
📦
exploratory-data-analysis
85分析科学数据文件
科学数据文件很难检查，因为每种格式存储结构和元数据的方式都不同。此技能可检测格式、分析数据质量，并创建实用的 Markdown EDA 报告。
数据与分析 查看
📦
diffdock
85运行 DiffDock 分子对接工作流
分子对接设置经常失败，因为输入、参数和置信度分数很难对齐。此技能会指导从准备到结果审查的 DiffDock 工作流。
研究与学习 查看
相关技能
查看全部📦
arxiv-search
75搜索 arXiv 研究论文
由 DougTrajano
研究人员需要快速访问可能尚未出现在期刊索引中的预印本。此技能会搜索 arXiv，并返回简洁的论文标题、摘要和链接。
研究与学习 查看
📦
active-research
38Research Topics and Generate Evidence Reports
由 actionbook
Broad research requests require many searches, source checks, and organized notes. This skill guides Actionbook browsing and turns findings into structured reports.
研究与学习 查看
📦
listening-script
74Create Listening Scripts That Preserve Evidence
由 godgod126
Screen-oriented articles and reports can be difficult to follow aloud without losing important evidence. This skill adapts them into narration with clear comparisons, audible uncertainty, and separate source notes.
写作与内容 查看
📦
pptx-posters
38创建 PPTX 研究海报
由 K-Dense-AI
研究团队需要易于在 PowerPoint 中预览、修订和编辑的海报文件。此技能指导 HTML 海报创建、视觉规划、PDF 导出和 PPTX 转换。
办公与报告 查看
📦
serenity-skill
90Research Supply-Chain Investment Bottlenecks
由 muxuuu
Broad investment themes often hide the scarce components that control growth. This skill maps value chains, grades evidence, and ranks research priorities with clear risks.
研究与学习 查看
📦
nature-figure
85创建可直接用于期刊投稿的 Nature 图件
由 Yuan1z0825
研究人员需要能够清晰传达证据并满足期刊导出规则的图件。此技能可将数据集、草稿和图件构想转化为结构化的 Python 或 R 工作流，用于生成可提交的视觉图件。
研究与学习 查看