Automates research by conducting literature searches, running experiments, and generating LaTeX papers from detailed research topics.

This package is feature-rich and appears to implement what it claims, but there are several mismatches and powerful runtime behaviors you should treat carefully: 1) Source provenance: 'Source: unknown' and no homepage — prefer software from a known repo or signed releases. 2) Secrets and keys: it expects LLM API keys and may reference many env vars (OPENAI_API_KEY, GEMINI_API_KEY, PRM_API_KEY, MINIMAX_API_KEY); do not expose more secrets than necessary and do not point it at ~/.ssh/id_rsa unless you understand the consequences. 3) Run in isolation: if you want to try it, install and run it inside a disposable VM/container with no access to your real SSH keys, sensitive files, or organization networks. 4) Inspect setup scripts: open `researchclaw setup`, `sentinel.sh`, and any install hooks before running them; they can install npm packages or Docker images. 5) Disable bridging/autoconnect features initially: set openclaw_bridge.* and metaclaw_bridge.* integrations to false and set opencode.auto=false before any autonomous runs. 6) Avoid --auto-approve until you have audited config and run a dry local test; prefer manual approval and small time/resource budgets. 7) If you need stronger assurance, ask the owner for a canonical repository link, signed release tarball, or a trimmed skill that only exposes the minimal capabilities you require. Finally, if you lack the ability to audit the code, do not run the skill with access to sensitive environments or credentials.

Type: OpenClaw Skill Name: auto-research-claw Version: 1.0.0 The AutoResearchClaw skill bundle is a highly sophisticated autonomous research pipeline. It demonstrates strong security awareness by implementing multiple defensive layers to mitigate risks associated with executing LLM-generated code. Specifically, it includes an AST-based security validator (researchclaw/experiment/validator.py) that blocks dangerous calls like os.system and eval, and utilizes Docker-based sandboxing with strict network isolation policies (researchclaw/experiment/docker_sandbox.py and researchclaw/agents/figure_agent/renderer.py). The code is well-structured, follows its stated purpose of automating literature search, experiments, and paper generation, and lacks any indicators of malicious intent such as data exfiltration or unauthorized persistence.