该 Skill 支持基于关键词的学术论文检索，可以设置发表时间范围与数量 并将论文下载到指定目录，帮助用户快速获取目标领域（如大模型）的最新或代表性研究成果。This skill enables keyword-based academic paper retrieval with optional constraints on time range and result size and download them in the folder.

Search and download related arXiv papers by topic plus date range, or from a seed paper title/id. Use when user asks to crawl related papers, collect arXiv a...

This skill appears to do what it says (query arXiv and download PDFs) and uses only Python standard libraries, but take these precautions before installing or running it: - Verify the repository layout: SKILL.md expects ./arxiv-related-papers/scripts/download_arxiv.py but the manifest shows scripts/download_arxiv.py — confirm the correct path or update the invocation. - Inspect the full script (the distributed file appears truncated in the bundle). The truncated tail could contain logic that changes behavior (file system writes, external endpoints, or other actions). Do not run until you have the complete source. - Confirm the script creates the output directory or will not overwrite unintended files. Run in a sandboxed environment or with limited write permissions to the target directory. - The script retries with an unverified SSL context if certificate verification fails; be aware this weakens TLS checks when that code path is taken. - Because it downloads many PDFs, ensure you have permission to write to the target directory and adequate disk space. Given the path mismatch and incomplete source, proceed only after obtaining and reviewing the complete file and correcting the invocation path. If you want, provide the rest of the script and I can re-evaluate with the full content.

Type: OpenClaw Skill Name: paper-search-and-download Version: 1.0.0 The skill is designed to search and download arXiv papers, but the script `scripts/download_arxiv.py` contains a security vulnerability: it intentionally bypasses SSL certificate verification using `ssl._create_unverified_context()` if a standard connection fails. This 'weak crypto' flaw makes the agent susceptible to Man-In-The-Middle (MITM) attacks when querying the arXiv API or downloading PDFs. While the code logic aligns with the stated purpose and lacks evidence of intentional malice or data exfiltration, the explicit inclusion of a security bypass for network requests is a high-risk behavior.