自动化23阶段科研流程，实现从研究想法到完整论文的生成，支持文献检索、实验设计和结果分析。

Key points before installing or running this skill: - Manifest mismatch: The skill metadata does NOT declare required env vars or the external 'researchclaw' CLI, but the code/README expect OPENAI_API_KEY, optional S2 API key, Python deps, and a researchclaw binary. Treat these as required and confirm them before use. - Command injection risk: The skill builds a shell command embedding the provided topic string and passes it to child_process.exec. If untrusted input is used for the topic, an attacker could inject arbitrary shell commands. Only run this in an isolated environment and avoid untrusted topics. - Code execution risk: The pipeline is designed to generate and run experiment code (sandbox/ssh_remote modes). Start in 'simulated' mode first and manually review any generated code before executing it locally or on a remote host. - Secrets & remote access: If you provide API keys or SSH credentials, ensure they are scoped/minimized and do not reuse high-privilege keys. The skill does not declare these in its manifest — add them to config.yaml or env vars yourself after reviewing the code. - Broken/unsafe code: The index.js file contains a likely syntax bug in updateConfig (malformed function signature) which may cause runtime failures; review and test the code before relying on it. - Best practices before use: audit the repository (especially the external 'researchclaw' CLI it executes), run in an isolated VM/container, keep API keys limited, run first with simulated mode and verify generated artifacts, and fix or sanitize the command-construction to avoid shell injection (e.g., use execFile or pass args as an array).