中文 EN

Scan Report

Scan New Files

⚠ Low Risk — Risk Score 15/100
Last scan:1 day ago Rescan
15 /100
paper-reading
Read academic papers from local PDF files, arXiv URLs, or paper titles and generate structured reading notes in Chinese.
A legitimate academic paper reading skill with minor documentation flaws (hardcoded user paths, unversioned dependency) but no security violations.
Skill Namepaper-reading
Duration41.1s
Enginepi
✓
Safe to install
Update hardcoded paths in SKILL.md to use relative paths or environment variables. Pin pdfplumber version to ensure reproducibility.

Findings 3 items

Severity Finding Location
Low
Hardcoded user-specific paths in SKILL.md Doc Mismatch
SKILL.md contains hardcoded paths with /Users/yihe/ which will not work for other users. These should use relative paths or document that users need to customize.
python /Users/yihe/.config/opencode/skills/paper-reading/scripts/fetch_pdf.py
→ Replace hardcoded paths with relative paths or document path customization.
 SKILL.md:17
Low
Unversioned dependency Supply Chain
pip install pdfplumber has no version constraint. This could lead to unexpected behavior if a breaking change is released.
pip install pdfplumber  # if not already installed
→ Pin to a specific version: pip install pdfplumber==0.11.0
 SKILL.md:23
Info
HTTP endpoint for arXiv API Doc Mismatch
The script uses http://export.arxiv.org/api/query instead of HTTPS. While arXiv is a legitimate academic resource, HTTPS would be more secure.
ARXIV_API = "http://export.arxiv.org/api/query"
→ Consider using HTTPS: https://export.arxiv.org/api/query
 scripts/fetch_pdf.py:25
ResourceDeclaredInferredStatusEvidence
Filesystem READ READ ✓ Aligned SKILL.md:17 - Validates local PDF existence
Network READ READ ✓ Aligned scripts/fetch_pdf.py:25 - Downloads PDFs from arXiv.org
Shell WRITE WRITE ✓ Aligned SKILL.md:23 - Executes python scripts for PDF extraction
Environment NONE NONE — No environment variable access found
6 findings
🔗
Medium External URL 外部 URL
https://cdn.nlark.com/yuque/0/2026/png/57569306/1767535158747-34ab19e4-bec9-4f80-bb38-e36d876b77d9.png
references/mHC.md:30
🔗
Medium External URL 外部 URL
https://cdn.nlark.com/yuque/0/2026/png/57569306/1767535744001-6619f6a6-10a5-4434-afe2-da36ff2d58af.png
references/mHC.md:304
🔗
Medium External URL 外部 URL
http://export.arxiv.org/api/query
scripts/fetch_pdf.py:25
🔗
Medium External URL 外部 URL
https://arxiv.org/pdf/
scripts/fetch_pdf.py:40
🔗
Medium External URL 外部 URL
http://www.w3.org/2005/Atom
scripts/fetch_pdf.py:62
🔗
Medium External URL 外部 URL
http://arxiv.org/schemas/atom
scripts/fetch_pdf.py:62

File Tree

5 files · 24.9 KB · 672 lines
Markdown 3f · 455L Python 2f · 217L
├─ ▾ 📁 references
│ ├─ 📝 mHC.md Markdown 323L · 13.6 KB
│ └─ 📝 note-template.md Markdown 50L · 1.7 KB
├─ ▾ 📁 scripts
│ ├─ 🐍 fetch_pdf.py Python 141L · 4.2 KB
│ └─ 🐍 read_pdf.py Python 76L · 2.4 KB
└─ 📝 SKILL.md Markdown 82L · 3.0 KB

Dependencies 1 items

PackageVersionSourceKnown VulnsNotes
pdfplumber * pip No Version not pinned

Security Positives

✓ No credential theft or harvesting detected
✓ No data exfiltration to external servers
✓ No obfuscation techniques (base64, eval, exec) found
✓ No subprocess abuse or shell command injection vectors
✓ Code is readable and straightforward with clear purpose
✓ Network access is limited to legitimate arXiv paper downloads
✓ No sensitive file access (no ~/.ssh, ~/.aws, .env access)
✓ No persistence mechanisms or backdoors
✓ No prompt injection attempts