Paper Impact Analyzer

Analyze academic paper impact using multiple data sources (arXiv, GitHub, OpenAlex, Semantic Scholar). Input an arXiv ID and get a multi-dimensional impact a...

This skill appears to be internally consistent with its description: it runs a Python script that queries arXiv, GitHub, OpenAlex, and Semantic Scholar and prints a Markdown impact report. Before running it, review and consider the following: 1) The script intentionally disables SSL certificate verification for outbound HTTPS requests and uses plain HTTP for the arXiv query — this exposes you to man-in-the-middle risk on untrusted networks. If you will run it on a laptop or cloud VM, either (a) modify the script to remove the SSL bypass (use the default SSL context) and use HTTPS for arXiv, or (b) run it in a network you trust. 2) The script makes multiple external network requests — expect rate limiting from GitHub and Semantic Scholar when unauthenticated; running batch jobs may hit limits. 3) The package contains duplicate files (root and skills/ copies) which is likely harmless but unusual; you may prefer to keep only one copy. 4) If you are concerned about privacy or data leakage, inspect the full script locally before execution; it does not read local environment variables or files in the visible portions, but you should verify the truncated parts if you plan to run it. 5) Run the script in an isolated environment (container or VM) if you want to limit risk. If you want, I can point out the exact lines to change to re-enable certificate verification and use HTTPS for arXiv.

Type: OpenClaw Skill Name: paper-impact-analyzer Version: 1.1.0 The skill analyzes academic paper impact by querying public APIs (arXiv, GitHub, OpenAlex, and Semantic Scholar). However, the script `scripts/analyze.py` explicitly disables SSL certificate verification (`ssl.CERT_NONE`), which is a significant security vulnerability that exposes the agent to Man-in-the-Middle (MITM) attacks. While the code appears to align with its stated purpose and lacks evidence of intentional malice or data exfiltration, this high-risk security flaw warrants a suspicious classification.