agentic-paper-digest-skill

Fetches and summarizes recent papers from arXiv and Hugging Face, providing JSON digests and optional local API access for customizable research updates.

This skill appears to do what it claims (download a paper-digest pipeline and run it locally), but it does so by cloning/downloading code from a GitHub repo and running pip install on requirements. Before installing or running bootstrap.sh: (1) inspect the GitHub repository contents (requirements.txt, the paper_finder package, and any scripts) to ensure you trust the source; (2) prefer cloning a pinned release/tag rather than main branch if you can; (3) review requirements.txt for unusual packages or post-install scripts; (4) run the bootstrap and server inside an isolated environment (container or VM) and avoid putting a long-lived high-privilege API key in an uncontrolled .env — use a scoped/limited key if possible; (5) resolve the metadata mismatch (README vs bootstrap repo owner) — ask the publisher which upstream repo is authoritative. If you cannot validate the remote repo and dependencies, treat this skill as potentially risky and avoid running its install scripts on sensitive hosts.

Type: OpenClaw Skill Name: modesty-agentic-paper-digest-skill Version: 1.0.2 The skill acts as a wrapper that downloads and executes code from an external GitHub repository (matanle51/agentic_paper_digest) via scripts/bootstrap.sh. It installs arbitrary Python dependencies and uses SKILL.md to provide mandatory instructions that steer the AI agent to perform these downloads and configurations automatically. While this behavior is aligned with the stated purpose of installing a paper digest tool, the 'bootstrap' pattern of fetching and running remote artifacts represents a significant supply chain risk and potential for remote code execution if the external repository is compromised.