Paperless

Interact with Paperless-NGX document management system via ppls CLI. Search, retrieve, upload, and organize documents.

This skill looks coherent for controlling Paperless-NGX via the ppls CLI, but before installing: 1) Verify the npm package identity and maintainer (check the GitHub repo and package contents) to ensure you’re installing the legitimate @nickchristensen/ppls package. 2) Prefer installing without -g (or use a container/venv) if you want to limit global code execution, and avoid running npm as root. 3) Confirm where ppls stores the configured token (config file) and protect that file (restrict filesystem permissions); consider a least-privilege API token for Paperless. 4) Double-check the registry metadata mismatch (top-level metadata showed no required env vars/bins while SKILL.md does) — treat that as a packaging issue to clarify with the publisher. 5) If you cannot vet the package, consider manually invoking Paperless-NGX API calls or using a known trusted client instead.

Type: OpenClaw Skill Name: paperless Version: 1.1.0 The skill bundle is classified as benign. The `SKILL.md` file clearly defines the purpose of interacting with Paperless-NGX via the `ppls` CLI. It requires `PPLS_HOSTNAME` and `PPLS_TOKEN` environment variables, which are necessary for its stated functionality and are not exfiltrated. The installation instructions specify a known npm package (`@nickchristensen/ppls`), and all command examples are legitimate operations for a document management system, including downloading files to the user's `~/Downloads` directory. There is no evidence of malicious prompt injection, data exfiltration, unauthorized execution, or persistence mechanisms.