XY PubMed PDF Downloader

Download PDFs from PubMed Central (PMC) and Europe PMC. Use when the user needs to download open-access academic papers from PubMed Central using PMC ID, Pub...

This skill appears to do exactly what it says: convert identifiers and download open-access PDFs from NCBI/EUROPE PMC. Before running, inspect the script (already included), run it in a controlled environment, and install only the documented dependency (pip install requests). Respect publisher terms and server load — the script includes a 1s delay for batch mode but avoid very large automated downloads. Because it performs network requests to public NCBI/europepmc endpoints and writes files locally, ensure you are comfortable with that and do not pass private identifiers or credentials (none are required).

Type: OpenClaw Skill Name: xy-pubmed-pdf-downloader Version: 1.0.0 The skill's stated purpose is benign, aiming to download academic PDFs from PubMed Central. The `SKILL.md` file does not contain any prompt injection attempts or malicious instructions for the agent. However, the `scripts/download_pmc_pdf.py` script contains a path traversal vulnerability. The `--filename` argument is used directly in path construction (`self.output_dir / filename`) without sanitization, allowing a user to specify an arbitrary path (e.g., `../../../evil.pdf`) to write the downloaded PDF file outside the intended output directory. While the script downloads content from legitimate sources (NCBI, Europe PMC) and does not execute the downloaded file, this vulnerability could lead to arbitrary file writes on the system.