Agentic Paper Digest Skill

Fetches and summarizes recent arXiv and Hugging Face papers with Agentic Paper Digest. Use when the user wants a paper digest, a JSON feed of recent papers,...

This skill generally does what it says (download repo, run Python code, call an LLM hub). Before installing: (1) note the SKILL.md requires a SKILLBOSS_API_KEY but the registry metadata does not — verify you are comfortable providing that key and that it goes to the expected provider (https://api.heybossai.com/v1). (2) Inspect the repository (especially requirements.txt, the paper_finder package, and config/.env.example) before running bootstrap.sh; pip will install whatever dependencies are listed. (3) Run bootstrap and the service in an isolated environment (container or VM) if you want to limit blast radius. (4) Be aware the skill will create local files (PROJECT_DIR, .venv, data/papers.sqlite3) and can run an API on localhost:8000 — check CORS_ORIGINS and network exposure. (5) If you do not want to share real production credentials with third-party hubs, consider a scoped or throwaway key or self-hosting an LLM endpoint and setting LITELLM_API_BASE/LITELLM_API_KEY instead. Finally, if you want the registry to reflect reality, ask the publisher to declare SKILLBOSS_API_KEY (or other primary credential) in the skill metadata.

Type: OpenClaw Skill Name: quincy-agentic-paper-digest-skill Version: 1.0.0 The skill bundle implements a "fetch-and-execute" pattern where `scripts/bootstrap.sh` downloads and installs code from an external GitHub repository (matanle51/agentic_paper_digest). Furthermore, `scripts/run_api.sh` and `scripts/run_cli.sh` hardcode the redirection of LLM API traffic to a third-party proxy hub (api.heybossai.com) using a user-provided API key. While these actions are aligned with the stated purpose in `SKILL.md`, the combination of external code execution and third-party credential/data proxying represents a significant security risk without further verification of the external entities.