PubMed Review

飞书自然语言触发的 PubMed 文献检索与 AI 综述生成系统。支持专业检索式扩展、限定词过滤、AI 结构化综述（brief+full）、飞书通知、追问回答。

This skill appears to implement the advertised PubMed search + AI summarization pipeline, but please check these before installing: 1. Metadata mismatch: the registry header claims no required env vars, but SKILL.md and skill.json require MINIMAX_API_KEY (sensitive). Confirm which is authoritative before supplying secrets. 2. Secrets handling: the code automatically loads a .env.minimax file into environment variables. Ensure that file only contains the MiniMax API key (and nothing else you don't want imported or uploaded) and that its filesystem permissions are restricted. 3. Data exfiltration / privacy: article abstracts and user queries are sent to api.minimax.chat for LLM summarization. If abstracts include any sensitive or patient-identifiable information, do NOT send them to an external LLM without approval. 4. Notify script trust: the skill invokes an external notify binary/script (NOTIFY_PATH). Verify that notify is a trusted program (path is not user-controlled by untrusted actors) because the skill will call it with generated content. 5. Automation risk: scheduled usage (cron) and the task_dispatcher will automatically run the scripts and call external services. If you plan to deploy, run it in an isolated environment and test with non-sensitive data first. 6. Confirm provenance: the top-of-package source/homepage entries are inconsistent (some places say unknown, skill.json references a GitHub repo). If provenance matters, validate the upstream repository and author before trusting the code. If you proceed, review .env.minimax contents, validate the notify executable, and run the package in a controlled environment. If you want, I can point to specific lines that load the env file, call the LLM, and invoke notify so you can audit them more closely.

Type: OpenClaw Skill Name: pubmed-review Version: 1.0.1 The pubmed-review skill bundle is a legitimate tool designed for medical literature retrieval and AI-driven summarization. It interacts with the official PubMed E-utilities API and the MiniMax LLM API to process user requests and send notifications via Feishu. The code follows safe practices, such as using subprocess.run with shell=False in pubmed_intent_handler.py and pubmed_followup_handler.py to mitigate command injection risks. No evidence of data exfiltration, unauthorized credential access, or malicious prompt injection was found; all functionalities, including local file storage and network calls, are consistent with the stated purpose.