pierrecagne submitted arXiv Assistant through omacom/omarchy-plugin-marketplace#11408 on October 13. It lists preprints from selected categories and generates AI reading reports for starred papers. github-actions[bot] reported publication that evening and closed the submission. Its automated verification applies to the exact marketplace snapshot and is not a security audit.
HANCORE-linux's review prompted successive privacy changes. The reviewer acknowledged that a per-run secret fixed unauthenticated report access, then flagged private reader context exposed through process arguments. pierrecagne reported moving configuration to standard input, making logs and reports private, and tightening permissions on existing recorded reports.
HANCORE-linux also identified that the Codex sandbox exposed its mounted credentials and past sessions to paper-processing tools. pierrecagne acknowledged the finding and removed Codex support instead of shipping an integration they could not test, in omacom/omarchy-plugin-marketplace#11408:issuecomment-6156586127. The remaining engines are Claude Code in its restricted mode and custom commands documented as unsandboxed.
