Research Report Generator

Research technical projects/papers and generate comprehensive reports with PDF export. Modes: lite (analysis + writing) or full (+ environment setup + experi...

This skill appears to be a lightweight, local report generator implemented as bash scripts — not a full autonomous research agent. Before installing or running it: - Understand what it actually does: the scripts create iterative Markdown drafts, list (but do not fetch) local project files, and convert Markdown to PDF locally with pandoc or an existing md2pdf skill. They do not perform web searches, download papers, perform automated experiments, nor send PDFs via Telegram despite those claims in SKILL.md. - If you plan to provide --project-path pointing to a local repo, be cautious: the skill will read files under that path (find -type f) and will create logs and report files in your workspace. It does not execute user code, but if you later run 'full' experiments manually you may execute untrusted code — do that in an isolated environment. - Verify the md2pdf path and pandoc availability on your system; the script will call $HOME/.openclaw/skills/md2pdf/scripts/md2pdf.sh if present, otherwise it invokes pandoc directly. - Because the documentation over-promises (remote fetching, Telegram delivery, automated experiments) but the code does not implement those steps, treat the skill as partial/incomplete. If you need the claimed features, request or inspect additional code that implements them. If you accept the current behavior, run the scripts in a controlled workspace (or container) and review the created files/logs afterward. - If you want to proceed but are security-conscious: run the scripts in a throwaway or sandboxed account/container and inspect the output and created files before granting broader access.

Type: OpenClaw Skill Name: research-report Version: 1.0.0 This skill is classified as suspicious due to significant vulnerabilities related to input sanitization. The `WORKSPACE` parameter in `scripts/research-report.sh` is used directly to construct output directories without sanitizing for path traversal sequences (e.g., `../`), allowing an attacker to write files to arbitrary locations on the filesystem (e.g., `/etc/reports`). Additionally, the `PROJECT_PATH` parameter is used directly in a `find` command, enabling information disclosure by listing files in arbitrary directories (e.g., `/etc`). While the skill's stated purpose involves broad capabilities like environment setup and experiment execution, these vulnerabilities are flaws that could be exploited, rather than evidence of intentional malicious design.