Automates scientific research by generating ideas, methodology, results, papers, and citations using the Denario framework with Z.ai integration.

Do not install blindly. Key points to consider before running: (1) The skill expects you to set OPENAI_API_KEY but the registry didn't declare it — confirm whether you should supply an OpenAI key or a Z.ai/Zhipu key; by default the scripts set OPENAI_BASE_URL to https://open.bigmodel.cn so your key would be used with that host. If you don't want your personal API key sent to a third party, do not run this skill until the base URL is changed. (2) test_citations.py contains a hardcoded PERPLEXITY_API_KEY — remove that or ask the author why it's embedded; it may be a leaked/shared credential. (3) The wrapper will create a virtualenv in your home (~/.denario_skill_env) and pip install packages — consider running in an isolated machine or disposable account if you want to test. (4) Review the scripts locally (they are included) and adjust OPENAI_BASE_URL and any hardcoded keys before running. (5) If you want to proceed, prefer using a dedicated API key with limited quota and monitor outbound requests; otherwise reject or request the maintainer to: declare required env vars, remove embedded keys, and make the target LLM host configurable and documented.

Type: OpenClaw Skill Name: denario-skill Version: 1.0.0 The skill is classified as suspicious primarily due to a hardcoded `PERPLEXITY_API_KEY` found in `scripts/test_citations.py`, which exposes a secret. Additionally, the Python scripts (`scripts/test_citations.py`, `scripts/test_paper.py`) modify the `PATH` environment variable to include a custom TinyTeX path, a risky capability, even if plausibly for LaTeX compilation. While there's no clear evidence of intentional malicious behavior targeting the user or platform (like user credential theft or backdoor installation), these practices represent significant security risks and poor security hygiene.