Paper Engineering Assistant

基于“框架层-总结层-正文层”三层架构的自动化论文写作与文献管理助手。严格按照用户指定的目录（`workspace/毕业论文`）组织所有文件。

This skill's documentation promises substantial automation (download PDFs, parse text, summarize, and automatic bidirectional sync) but the provided code is a small, mostly placeholder script that only creates directories, lists project structure, and contains a stub for updating summaries. Before installing or using it: 1) Back up any real thesis/work directories — the skill explicitly overwrites body files. 2) Ask the author for the missing implementations: what libraries/tools will be used for PDF parsing, what network endpoints will be contacted, and how synchronization is triggered (file watcher, webhooks, or manual). 3) If you need network access disabled, run the skill in an isolated/test folder or restrict its network privileges. 4) Prefer to run the included agent.py in a sandbox to confirm behavior and to obtain a complete implementation (download/parsing/sync code) before giving it access to important files. If the author cannot justify where downloads will come from or cannot provide the actual parsing/sync code, treat the skill as incomplete and avoid using it on important data.

Type: OpenClaw Skill Name: paper-engineering-assistant Version: 1.0.1 The skill requests broad permissions, including 'Filesystem read/write' and 'network access', as declared in SKILL.md. While these permissions are plausible for an academic writing assistant, the instructions in SKILL.md for the agent to parse arbitrary reference files (e.g., PDFs) and perform network downloads based on user-provided keywords introduce significant vulnerability risks. These capabilities could be exploited through parser vulnerabilities or by tricking the agent into downloading/processing malicious content or performing SSRF, even though the provided `agent.py` code does not explicitly implement these risky parsing/downloading functions, nor does it show clear malicious intent.