PubMed Search

AI-powered tool for searching and analyzing PubMed biomedical literature

This skill looks coherent for PubMed searching and analysis; the included Python code matches the SKILL.md. Before installing or running: 1) Review the included pubmed_search.py yourself (it is present) to confirm behavior; 2) Avoid blindly running recommended remote installer commands (curl | sh) or npx clone commands from unknown GitHub accounts — instead inspect those scripts and the remote repo first; 3) If you provide PUBMED_EMAIL or PUBMED_API_KEY, know the email will be sent to NCBI as part of API calls (expected for polite API usage); 4) Use a dedicated directory/virtualenv when installing dependencies and check that only requests and python-dotenv are installed; 5) If unsure about the GitHub source (owner JackKuo666), prefer installing from the packaged files you already received or from an official/trusted repo.

Type: OpenClaw Skill Name: pubmed-search-skill Version: 0.1.0 The OpenClaw skill 'pubmed-search-skill' is classified as benign. The code (`pubmed_search.py`) and documentation (`SKILL.md`, `README.md`) align with its stated purpose of searching and analyzing PubMed literature. All network requests are directed to legitimate NCBI/PubMed endpoints, and environment variables accessed (`PUBMED_API_KEY`, `PUBMED_EMAIL`, `PUBMED_TOOL`) are relevant to API interaction. While the installation instructions include `curl -LsSf https://astral.sh/uv/install.sh | sh`, this is a common, albeit generally risky, method for installing developer tools from their official source, and does not indicate malicious intent by the skill developer. There are no signs of data exfiltration, unauthorized command execution, persistence mechanisms, or malicious prompt injection against the AI agent. The potential for path traversal via output file arguments is a vulnerability if exploited by a malicious calling agent, but the skill itself does not demonstrate intent to exploit this.