SemanticScholar Search Skill

Search academic papers, authors, and citations with detailed metadata using the Semantic Scholar API, supporting queries, paper details, author profiles, and...

The skill's code and documentation are internally consistent with a Semantic Scholar client, but exercise caution before installing from an unverified source. Recommendations: - Prefer cloning the repository and reviewing files locally rather than running remote installers (avoid curl | sh). - Inspect the GitHub repo (owner JackKuo666) and commit history; confirm the code matches the packaged files. - Install dependencies inside an isolated virtual environment or sandbox (venv or container) rather than system-wide. - Avoid running the recommended remote installer (astral.sh) unless you trust that third-party tool; install uv or tools from their official pages or package managers instead. - If you need higher rate limits, provide an official Semantic Scholar API key only to the local process in a safe environment. If you can verify the repository and avoid running unreviewed remote scripts, the skill appears reasonable; if you cannot verify the source, do not install.

Type: OpenClaw Skill Name: semanticscholar-search-skill Version: 0.1.0 The skill's core functionality for searching Semantic Scholar is benign. However, the `semantic_scholar_search.py` script contains a path traversal vulnerability: the `--output` argument, which allows users to specify a file path for results, does not sanitize the input. This means an attacker could potentially write benign JSON data to arbitrary file locations (e.g., `../../../../tmp/output.json`), leading to unauthorized file modification or denial of service, although not direct code execution or data exfiltration with malicious content.