paper-research-assistant

科研论文研读与复现自动化助手。使用当用户需要：(1) 研读论文 PDF 并提取核心内容，(2) 生成结构化研读报告，(3) 查找官方代码/数据集，(4) 编写复现代码框架，(5) 设计实验方案复现论文结果

This package looks like a legitimate paper-reading / scaffold generator but it is sloppy and incomplete. Things to consider before installing or running: - Path mismatches: SKILL.md refers to scripts/ and references/ subfolders (e.g., scripts/parse_paper.py, references/report_template.md), but the actual files are at the repository root. Running the example commands as-written will likely fail unless you move/rename files or adjust paths. - Missing web/resource search: SKILL.md describes automated searches of arXiv, GitHub, HuggingFace, and license verification. The provided scripts do not perform network/API calls for that — the AI agent or you would need to implement those steps separately. Do not assume the skill will automatically fetch remote resources. - Data handling: parse_paper.py extracts full text and writes a 5000-character preview into the metadata JSON. If you give it private or embargoed PDFs, that content will be written to disk. Run in a safe environment and inspect outputs if privacy is a concern. - Code generation: scaffold_code.py will create files under the output directory you specify. Review generated files (e.g., requirements.txt, placeholder dataset code) before executing any generated training scripts. Requirements and placeholders may need correction (e.g., package names/versions). Recommended actions: 1. Run the scripts in an isolated environment (container/VM) the first time. 2. Fix or adapt the path references in SKILL.md or move files into the expected directories so examples work as intended. 3. If you need automatic resource discovery (GitHub/arXiv/HuggingFace), implement or verify a network-safe method and confirm any API tokens/credentials are handled securely (this skill does not request them). 4. Inspect outputs (metadata JSON, generated code) before running any generated training jobs to avoid accidental execution on sensitive data or unexpected code. Given the inconsistencies and missing functionality (not strictly malicious), treat the skill as potentially useful but immature; review and test it before trusting it with sensitive papers or running generated experiments.

Type: OpenClaw Skill Name: paper-research-assistant Version: 1.0.0 The skill bundle is classified as suspicious due to the potential for prompt injection against the AI agent. The `parse_paper.py` script extracts text from user-provided PDFs, and `generate_report.py` and `scaffold_code.py` then incorporate this user-derived metadata (e.g., paper title, abstract) into generated Markdown reports and code READMEs. While `scaffold_code.py` attempts some sanitization for file/class names, it does not fully sanitize against arbitrary string injection into generated content. If the OpenClaw agent subsequently reads and acts upon these generated files, malicious content embedded in the original user input could be interpreted as prompt injection commands, posing a significant vulnerability in the overall system's handling of untrusted input and generated output.