ScholarGraph

Academic literature intelligence toolkit for multi-source paper search, analysis, and knowledge graph building with AI assistance.

This skill appears coherent for academic literature tasks, but take these precautions before installing: 1) Verify the upstream source: the SKILL.md points to a GitHub repo — confirm the repo and its recent commits match the package you get. 2) Inspect package.json for postinstall or install scripts that run arbitrary commands. 3) Run installation and execution in a sandboxed environment (container or VM) the first time. 4) Only provide API keys you control and prefer minimally-scoped/read-only keys; avoid pasting high-privilege credentials. 5) If you rely on privacy, remember the tool performs network calls and persists a local SQLite DB (data/knowledge-graphs.db by default); review or override the configured paths. 6) If you need higher assurance, review the omitted files and any network endpoints they call to check for unexpected telemetry or data exfiltration.

Type: OpenClaw Skill Name: scholargraph Version: 1.4.3 The ScholarGraph skill is a comprehensive academic research toolkit that integrates with numerous academic APIs and uses local SQLite for data persistence. However, it exhibits high-risk behavior in 'paper-viz/scripts/pdf-figure-extractor.ts' and 'paper-viz/scripts/ppt-exporter.ts', where it dynamically constructs Python scripts using string interpolation and executes them via sub-processes ('spawn'). While this logic is intended to facilitate PDF image extraction and PPT generation, the lack of robust sanitization for variables like 'pdfPath' and 'outputDir' within the Python string templates could potentially allow for code injection if an agent is directed to process maliciously named files or metadata. No evidence of intentional malice or data exfiltration was found, but the execution pattern is inherently risky.