PaperTamer is a local review workflow for trusted LaTeX projects. It is not an agent sandbox, an access-control layer, or a validator of scientific truth.

• TeX is executable input. Builds disable shell escape and skip latexmk rc files, but do not safely sandbox malicious TeX. Do not open an untrusted project with compilation enabled.
• PaperTamer itself makes no model/API calls and adds no telemetry. Cursor, your agent, the TeX distribution and separately installed extensions have independent behavior and policies.
• .papertamer/ contains source snapshots, paths, decisions, logs, PDF/SyncTeX data and backups. Keep it private. .gitignore reduces accidental inclusion but is not encryption or permission enforcement.
• Proposal and decision files are local workflow state, not signed authorization. The Skill forbids agents from forging approvals, but an agent with filesystem access can bypass those instructions. Keep version control and inspect meaningful changes.
• Path traversal, symlinked review targets and overlapping manual edits are rejected by normal workflows. These checks are not a defense against another process racing or deliberately rewriting the workspace.
• Export may replace only the configured delivery file and first backs up an existing file. Configure a delivery path, not an input figure or a file belonging to another workflow.
• If a build fails or inputs change during compilation, the last matching preview is retained. It must be labeled and read as the last compiled version, not the current uncompiled source.

For reports, use a minimal non-confidential reproduction. Do not attach unpublished manuscripts, .papertamer/ archives, personal configuration, tokens or full editor logs. If private vulnerability reporting is available on the repository's Security tab, use it; otherwise begin with a non-sensitive issue asking for a private channel. There is no guaranteed response-time commitment.