Paper Viz

从论文 PDF、实验截图或表格图片中提取实验结果，自动匹配图表类型，调用 Python 生成确定性图表，并导出 PNG、PDF 和 LaTeX；默认在用户指定输出根目录下自动创建与论文同名的文件夹保存结果。

What to consider before installing: - The skill will try to read local PDFs/images, write files, and run Python code automatically unless blocked. That is expected for a visualization tool, but it also means generated Python could perform arbitrary actions if executed without review. - The package metadata lists no required binaries or dependencies, yet the skill needs Python and likely OCR/PDF and plotting libraries. Ask the publisher for an explicit dependency list (Python version, required pip packages, any external binaries like Tesseract/poppler) or provide those yourself. - Prefer running this in a sandboxed environment: a VM or container with limited file access and no network egress, or require the agent to produce code for your review before execution. - Provide an explicit output folder (do not rely on default CWD) and request a preview step before plotting if you want manual control. - If you cannot verify dependencies or code, do not allow autonomous execution; instead require the agent to output experimental_data.json and plotting code for manual inspection and execution. What would change this assessment: seeing an explicit dependency/install spec, a declared Python binary requirement, or code files with transparent, reviewable plotting scripts and clear sandboxing instructions would move this toward benign. Conversely, any added steps that auto-execute downloaded code or request unrelated credentials would increase suspicion.

Type: OpenClaw Skill Name: paper-viz Version: 1.0.0 The paper-viz skill automates a data extraction and visualization pipeline that includes reading local files, writing to the filesystem, and executing Python code. The SKILL.md instructions explicitly command the agent to bypass user confirmation ('Do not ask for step-by-step confirmation' and 'Default to execution-first behavior'), which removes the human-in-the-loop for high-risk operations. While the intent appears to be a legitimate productivity tool, this automated execution policy combined with the processing of untrusted PDFs/images creates a significant surface for indirect prompt injection and unauthorized file operations.