Research

Conduct open-ended research on a topic, building a living markdown document. Supports interactive and deep research modes.

This skill's docs expect a 'parallel-research' CLI and 'export-pdf' script plus a PARALLEL_API_KEY, but those scripts and the env var are not declared or bundled. Before installing or following SETUP.md: 1) Ask the author for the missing scripts (or a trusted release URL) and for a homepage/repo so you can review their code. 2) Do not blindly run the curl | sh installer (astral.sh) — audit that script or install uv/pymupdf via your distro/package manager instead. 3) Prefer storing API keys in a secure secret store or OS keyring rather than echoing into a plaintext file and appending 'export' into ~/.bashrc. 4) If you must symlink scripts, inspect them first and avoid system-wide /usr/local installs unless you trust the source. 5) Verify how cron payloads deliver messages and what data they include (cron jobs could leak results or identifiers to external channels). If the author provides the missing artifacts and a trustworthy source for the uv installer, the architecture is reasonable; without that, the package is inconsistent and should be treated with caution.

Type: OpenClaw Skill Name: research-agent Version: 1.0.0 The skill is classified as suspicious due to several risky practices and potential vulnerabilities, despite lacking clear evidence of malicious intent. Key indicators include the `SETUP.md` file using `curl -LsSf ... | sh` for installing `uv`, which introduces a supply chain risk, and the use of `export $(cat ... | xargs)` for loading API keys, which can be vulnerable if the `.env` file is untrusted. Most critically, the `OPENCLAW.md` file instructs the agent to schedule cron jobs with a `message` payload that contains direct command execution instructions (e.g., `Run: parallel-research result <run_id>`). While intended for legitimate functionality, this represents a prompt injection vulnerability that could lead to remote code execution if the `<run_id>` or other parts of the message were controllable by an attacker.