Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Literature Daily Report
v1.0.0每日科研文献日报生成与管理。当用户请求生成科研日报、更新文献收集脚本或分析研究趋势时激活。支持：(1) 自动抓取 PubMed/bioRxiv/arXiv 最新文献，(2) 语义筛选 AI/生信/病原/真菌等领域，(3) LLM 智能总结与编辑排版，(4) 中文格式报告输出与定时任务管理。
⭐ 0· 46·0 current·0 all-time
byFang, Chao@biociao
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The stated purpose (collecting PubMed/bioRxiv/arXiv, semantic filtering, LLM summaries, Markdown reports) matches the code and instructions: the Python script and SKILL.md implement fetching, categorization, scoring and report generation. However, the SKILL.md and code also describe Zotero integration (automatic add-to-group) and reference a Zotero helper script path; those integration points were not declared in the skill registry (no required env or primary credential listed). That mismatch is unexpected.
Instruction Scope
Runtime instructions tell the agent to run the included Python script and optionally configure env vars (ZOTERO_API_KEY, ZOTERO_GROUP_ID) and cron jobs. The SKILL.md explicitly instructs automatic synchronization to a ClawLib directory and automatic addition to a Zotero Group Library. The instructions reference a specific path (~/.openclaw/workspace/skills/zotero/scripts/zotero.py) and suggest exporting Zotero credentials — i.e., they instruct access to credentials and execution of another skill's script. Those actions (using another skill's script path and writing/syncing files) broaden scope beyond simple fetching-and-summarizing and were not declared.
Install Mechanism
No install spec is provided (instruction-only with an included Python script). Nothing in the manifest downloads arbitrary archives or runs an external installer. Risk here is low from the install mechanism itself, but the shipped script will run on the host when invoked.
Credentials
The registry lists no required env vars, but SKILL.md and the script expect/use Zotero-related environment variables (ZOTERO_API_KEY and ZOTERO_GROUP_ID). The script also hardcodes a default ZOTERO_GROUP_ID ('6489333') and a path to a zotero.py script inside another skill's directory. Requesting/using an API key that can modify a third-party group library is a privileged action and should have been explicitly declared.
Persistence & Privilege
The skill writes reports and caches under ~/.openclaw/workspace/literature and auto-syncs to ~/.openclaw/workspace/ClawLib/科研日报/. It also references and may execute a script from ~/.openclaw/workspace/skills/zotero/, meaning it can invoke other skill code on the system. The skill is not marked always:true, but its ability to write files and call another skill's script increases its blast radius and should be reviewed before enabling automated runs.
What to consider before installing
Key things to check before installing/running: (1) The skill's manifest did not declare any required credentials, but the README and script ask you to export ZOTERO_API_KEY and ZOTERO_GROUP_ID — only provide keys if you trust the code and understand what 'adding to the BioCiaoLab Group' means. (2) Inspect scripts/literature_collector.py (and the referenced zotero.py) yourself: the collector will make network requests and write files to ~/.openclaw/workspace; the zotero integration may call external APIs that modify a remote group library. (3) The script points to ~/.openclaw/workspace/skills/zotero/scripts/zotero.py — ensure that file exists and review it; avoid running the skill if it will execute unknown code from other skills. (4) If you plan to run this automatically (cron), run it once interactively in a controlled environment (or sandbox) to see what it does and what network calls it makes. (5) If you do not want automatic uploads to Zotero or syncing to ClawLib, remove or disable those parts (unset ZOTERO_API_KEY, edit the code to skip sync) before enabling automation.Like a lobster shell, security has layers — review code before you run it.
bioinformaticsvk97dtd8s85mzywfhvf2hbga9gh83xvv8knowledge-graphvk97dtd8s85mzywfhvf2hbga9gh83xvv8latestvk97dtd8s85mzywfhvf2hbga9gh83xvv8literaturevk97dtd8s85mzywfhvf2hbga9gh83xvv8zoterovk97dtd8s85mzywfhvf2hbga9gh83xvv8
License
MIT-0
Free to use, modify, and redistribute. No attribution required.