A research is searching around something.

6-step structured research skill. Searches arXiv, reads 5 papers via markitdown, has Claude select the best 2, runs 4 targeted web searches (explanation, Git...

This skill largely does what it says (download papers, convert, web-search, synthesize) but has a few red flags you should resolve before installing: - Confirm which LLM provider it will use: the code calls Anthropic/Claude endpoints and has a --anthropic-key flag, but the registry only lists OPENROUTER_API_KEY. Ask the author which key the tool needs and whether OpenRouter or Anthropic will be used. Do not provide unrelated credentials. - Review the code paths that send extracted PDF/text/web content to remote APIs (OpenRouter / Anthropic / Serper). If you plan to run on sensitive topics or internal URLs, be aware those contents will be transmitted externally. - The included web_fetcher supports proxy pools, stealth headers, and curl_cffi fingerprinting — useful for scraping but able to bypass rate-limits/blocks. If that worries you, run the tool in a sandbox, restrict networking, or remove/disable proxy features. - The SKILL.md tells you to pip-install packages and copy the script into /usr/local/bin. Prefer running inside a virtualenv or container instead of installing system-wide, and inspect the scripts' source before making them executable. If you cannot get clarification from the publisher, treat this skill as untrusted: run it in an isolated environment, avoid supplying extra credentials until clarified, and consider adding the missing ANTHROPIC_API_KEY to the declared metadata only after confirming its legitimate need.

Type: OpenClaw Skill Name: q-research Version: 1.3.0 The OWL research skill is a legitimate tool designed to automate academic and web-based research. It uses the arXiv API for paper discovery, the markitdown library for PDF-to-text conversion, and OpenRouter/Serper APIs for synthesis and web searching. Security analysis of 'owl.py' and 'web_fetcher.py' shows proper input sanitization (e.g., regex-based filename cleaning) to prevent shell injection, standard use of environment variables for API keys, and no evidence of data exfiltration or malicious persistence. The 'web_fetcher.py' script includes advanced scraping features like rate limiting and browser fingerprinting, which are consistent with its stated purpose of fetching web content for research.