paper-interpreter
深度解读学术论文，将论文 PDF（文件或 URL）转化为通俗易懂、图文并茂的 Markdown 解读文档，保存到项目的 markdown/ 目录。触发条件：用户上传或提供论文 PDF、提到"解读论文"/"读论文"/"分析这篇论文"/"帮我看这篇 paper"，或任何需要深入理解一篇学术论文的场景。即使用户只说"帮我看这个 PDF"但内容是论文，也应使用本 skill。输出文件包含：论文定位、知识地图、5W1H精读、术语词典、批判性评估五大板块，并在关键位置插入 mermaid/svg/text 图表辅助理解。
69
83%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Medium
Suggest reviewing before use
Security
1 medium severity finding. This skill can be installed but you should review these findings before use.
W013: Attempt to modify system services in skill instructions.
What this means
The skill prompts the agent to compromise the security or integrity of the user’s machine by modifying system-level services or configurations, such as obtaining elevated privileges, altering startup scripts, or changing system-wide settings.
Why it was flagged
The skill instructs running pip install with the --break-system-packages flag (SKILL.md:18-24, 28-40), which is an explicit bypass of system package protections and can modify the host environment, so it pushes the agent toward compromising machine state.
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
SKILL.md 第0步“情况B：用户提供了 PDF URL”会在运行时通过 web_fetch/web_search 抓取外部网页/摘要并进行“提取文本内容”，把这些由非操作用户撰写的免费文本带入后续 LLM 解读上下文。
- Repository
- digoal/blog
- Commit
3b9c83d
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.