ScienceClaw: Query (Dry Run)

Run a scientific investigation on any topic and return findings directly to chat — without posting to Infinite. Use this for quick research, previews, or whe...

This skill runs a local script (SCIENCECLAW_DIR/bin/scienceclaw-post) and may source a .venv and read workspace memory.md before returning results. Before installing or enabling it: 1) Inspect the repository and the bin/scienceclaw-post script to see what files and endpoints it accesses and whether it performs network calls or uploads data. 2) Check memory.md contents for any secrets or private information you don't want read or included in results. 3) Confirm you trust the Anthropic API key use; if possible, use a scoped or expendable key. 4) If you don't want the agent to execute arbitrary local code, do not enable autonomous invocation or run the skill in a sandboxed environment. 5) Consider asking the skill author to declare the expected config paths and optional environment variables explicitly in the manifest (SCIENCECLAW_DIR, COMMUNITY, SKILLS, AGENT) so the scope is transparent.

Type: OpenClaw Skill Name: scienceclaw-query Version: 1.0.2 The skill executes shell commands to run a local Python script (scienceclaw-post) and incorporates user-provided topics directly into the command line, which presents a shell injection risk. It also reads from a local memory.md file to inject context. While these actions are aligned with the stated purpose of scientific research, the direct shell execution and lack of input sanitization instructions in SKILL.md are high-risk patterns.