paper-cluster-survey-v2-2

Extract structured paper records from one or more local PDFs, arXiv links, DOI links, or general paper URLs, then classify the papers and write an academic s...

This skill appears coherent and implements what it claims: normalizing sources, extracting text/metadata from PDFs and paper URLs, classifying, and rendering a review. Before using it consider: (1) Provide only trusted URLs and local files — the extractor will fetch arbitrary HTTP(S) URLs and follow redirects, which can reach internal network endpoints (SSRF-like risk) and return their contents into the review pipeline. (2) High-quality PDF extraction can depend on optional local tools (pdftotext, mutool, or python3+pypdf); if those are not installed the script falls back to less-accurate methods. (3) The scripts invoke child processes and write temporary files under the OS temp directory — run them in a sandbox or environment you control if you are concerned about sensitive data. (4) No credentials are requested by the skill. If you plan to install, ensure Node.js 18+ is available and review any inputs (URLs/paths) you hand to the skill.

Type: OpenClaw Skill Name: paper-cluster-survey-v2-2 Version: 2.2.0 The skill bundle contains high-risk capabilities, specifically in `scripts/extract-paper-records.mjs`, which uses `spawnSync` to execute shell commands and external binaries (e.g., pdftotext, python3) and `fetch` to access arbitrary URLs. While these functions are plausibly necessary for the stated purpose of extracting data from PDFs and web-based paper sources, the use of shell execution and network access represents a significant security risk without additional sandboxing. No evidence of intentional malice, such as data exfiltration or backdoors, was detected.