C — Moderate risk signals Graded October 16, 2026Several concerns worth a closer look before you install.Based on public adoption and transparency signals as of October 16, 2026. Our opinion, not a code audit or security guarantee.
AI agent skill · General
paperasse
🇫🇷 Skills pour agents IA spécialisés dans la bureaucratie française : Comptable, Notaire, ...
Bottom line: Signal-based grade (3/7 points): well starred on GitHub, public source code. This reflects adoption and transparency, not a code audit.
- Popularity score
- 39/100
- Rank
- #364 of 500
- GitHub stars
- 2.5k
What it does
Paperasse provides AI agent skills specialized for French bureaucratic processes, targeting roles like accountants and notaries. It appears designed to automate document handling, form processing, and regulatory compliance tasks specific to the French administrative system.
Who it’s for
French-speaking enterprises, accounting firms, notarial practices, and AI builders automating French regulatory workflows. Organizations dealing with URSSAF, tax authorities, or French corporate compliance.
Copy-paste setup
Check these steps against the project’s own instructions before running anything.
Verify against the repo README at https://github.com/romainsimon/paperasse (opens external site) for current installation and configuration steps. The project structure suggests npm-based distribution, but exact setup instructions should be confirmed directly from the repository's documentation.
Risks
- Credential scope: Skills likely require access to sensitive tax IDs, social security numbers, or notarial credentials—verify permission boundaries carefully
- Regulatory compliance: French data handling must comply with RGPD; unclear if the tool includes audit logging or compliance frameworks
- Supply chain: Minimal npm adoption (0 weekly downloads) and no visible security disclosure policy raise questions about active maintenance and incident response
- Prompt injection: French-language processing and form automation could be vulnerable to injection attacks if user input isn't properly sanitized
- Data residency: Unclear whether documents and PII remain on-premises or transit external services
How to stay secure
Least-privilege permissions
- Restrict credential access: Configure the skill to access only the specific tax IDs, social security numbers, or notarial certificates it actually needs—never grant "all documents" permission. Review permissions quarterly.
- Separate user roles: Create distinct accounts for different job functions (e.g., tax filing vs. notarial work). A comptable should not access notary credentials, and vice versa.
- Audit who can deploy: Only allow trusted administrators to install or update the paperasse skill; prevent regular users from modifying its configuration.
- Time-bound access: If possible, enable the skill only during working hours or specific project windows rather than leaving it permanently active.
Network isolation
- Limit outbound connections: Restrict the skill to communicate only with approved French systems (e.g., official tax portals, notary databases). Block unexpected external IP addresses or cloud services.
- Air-gap sensitive documents: Keep highly confidential files (original notarial deeds, tax returns with PII) on isolated machines or offline storage; only move encrypted copies to systems where the skill operates.
- Use a VPN or private network: Run the skill within your organization's secured network, never on public internet-facing servers.
Monitoring
- Enable activity logging: Require the skill to log every document accessed, credential used, and action performed—with dates, times, and user names. Store logs separately from operational systems.
- Review RGPD compliance: Verify the tool includes data retention policies and deletion logs. Confirm no personal data is retained longer than necessary or sent outside France without legal basis.
- Set up alerts: Configure notifications if the skill attempts unusual actions (e.g., bulk downloads, credential exports, or modifications outside normal business hours).
Red flags to watch for
- Unmaintained code: Paperasse shows minimal community adoption (near-zero weekly downloads) and no published security policy. Treat this as a high-risk dependency and consider alternatives.
- Unclear data flow: If you cannot trace where documents and PII go (on-premises, cloud, third-party services), do not deploy the skill until the vendor clarifies data residency in writing.
- Unexpected form behavior: Watch for forms that accept unusual characters or commands (especially French accents, quotes, or encoded text) without validation—this may indicate susceptibility to prompt injection attacks.
- No incident response plan: Before using the skill in production, confirm your vendor has a security disclosure policy and a timeline for fixing vulnerabilities. If absent, escalate to leadership.
Alternatives
- Docusign eSignature – established enterprise e-signature with regulatory certifications
- Yodlee – financial data aggregation for compliance workflows
- LawGeex – AI contract review (broader than French-specific, but proven compliance tooling)
- Custom integrations with French gov APIs (e.g., tax service APIs) for direct regulatory automation