Semantic Paper Radar

Semantic literature discovery and synthesis across arXiv/OpenAlex/PubMed (and optional Google Scholar adapters). Use when users ask for domain must-read pape...

This skill appears to do what it says — it queries OpenAlex, PubMed, and arXiv and ranks papers — but take these precautions before installing or enabling it: - Review the full, untruncated script on disk (the preview was truncated). The analysis above used the visible portion; any hidden/truncated code could change this assessment. - Be aware queries are sent to external public APIs (api.openalex.org, eutils.ncbi.nlm.nih.gov, export.arxiv.org). Do not send private or patient-identifiable data through this skill. - Note: the arXiv query uses HTTP (export.arxiv.org) in the visible code (unencrypted); if confidentiality is important, update to HTTPS or confirm arXiv's recommended endpoint. - The tool can export HTML to a path you control; confirm file paths before exporting to avoid accidental overwrites. - The SKILL.md suggests calling an existing Scholar-capable tool if present — ensure any cross-skill calls don't expose tokens/credentials belonging to other skills. - If you require higher assurance, run the script in a sandboxed environment or review the entire file contents locally to ensure there is no unexpected network endpoint or data-exfiltration behavior.

Type: OpenClaw Skill Name: semantic-paper-radar Version: 0.1.0 The skill bundle is classified as suspicious due to potential vulnerabilities rather than explicit malicious intent. The `scripts/paper_radar.py` file is vulnerable to path traversal via the `--html-out` argument, allowing an attacker to write files to arbitrary locations on the filesystem. Additionally, the `SKILL.md` instructions for executing the Python script with a user-provided `--query` argument (`python3 scripts/paper_radar.py search --query "<topic>"`) introduce a risk of shell injection if the AI agent does not properly sanitize or escape user input before passing it to the command line. There is no evidence of intentional data exfiltration, backdoors, or other malicious activities; network calls are restricted to legitimate academic APIs (arXiv, OpenAlex, PubMed).