Scholar Research

Search, analyze, and summarize peer-reviewed academic papers from open access sources. Provides credibility scoring, visualization, timeline generation, and...

This repository appears coherent with its description: it searches public academic APIs, downloads PDFs, scores and summarizes papers, and extracts figures using optional system tools. Before installing or running it, consider: 1) Run in a sandbox or VM since it performs network requests and writes downloaded PDFs to disk. 2) Figure extraction uses pdftotext/pdfimages (Poppler) via subprocess; install those if you want full functionality or disable figure extraction. 3) test_runner.py contains a hardcoded chdir to '/home/bigclaw/.openclaw/…' — do not run that file as-is (it's a development/test artifact). 4) Provide API tokens/email only for services you trust and avoid putting sensitive credentials in config files you share. 5) The package has minor packaging/path issues (CLI entry point and imports) that are engineering issues, not security problems. If you want higher assurance, request provenance (homepage/source repo) from the publisher or run the code in an isolated environment and audit network behavior during a sample run.

Type: OpenClaw Skill Name: scholar-research Version: 1.0.0 The skill is classified as suspicious due to its use of `subprocess.run` to invoke external binaries (`pdftotext`, `pdfimages`) for processing untrusted PDF files downloaded from the internet. While the `subprocess.run` calls are structured to prevent direct shell injection by passing arguments as a list, processing untrusted input with external tools introduces a vulnerability surface. A maliciously crafted PDF could potentially exploit vulnerabilities in `pdftotext` or `pdfimages`, leading to arbitrary code execution or other system compromises. This represents a significant vulnerability risk, though not clear evidence of intentional malicious behavior by the skill developer.