Literature Daily Report

ReviewAudited by ClawScan on May 10, 2026.

Overview

The literature-report workflow is mostly coherent, but it can automatically use Zotero account access to write into a group library even though credentials are not declared in the registry.

This skill appears suitable for generating public-literature reports, but review the Zotero integration carefully before installing. Do not provide a Zotero API key until you have verified the group ID, inspected the referenced Zotero helper, and decided whether automatic group-library writes, ClawLib syncing, and any cron schedule are appropriate.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If configured, the skill may automatically add literature items and tags to a shared Zotero group, potentially modifying a collaborative library without a separate review step.

Why it was flagged

This asks for Zotero account credentials and says the skill will automatically write to a group library. The registry metadata lists no credentials or required env vars, and the artifacts do not describe confirmation or rollback controls for those writes.

Skill content
文献收集完成后会自动录入 **BioCiaoLab Group Library** ... export ZOTERO_API_KEY="your-api-key" ... export ZOTERO_GROUP_ID="your-group-id"
Recommendation

Use a limited-scope Zotero API key, verify the group ID before running, and consider disabling or adding confirmation around Zotero writes.

What this means

Zotero behavior may depend on another local skill/script that was not reviewed here.

Why it was flagged

The collector references a Zotero helper outside this skill's included manifest, so the provided artifacts do not show the exact code that would perform the Zotero integration.

Skill content
ZOTERO_SCRIPT = os.path.expanduser("~/.openclaw/workspace/skills/zotero/scripts/zotero.py")
Recommendation

Inspect the referenced Zotero helper script before enabling Zotero integration, especially before providing an API key.

What this means

If the user adds the cron entry, the report workflow may keep running daily and may continue syncing or sending outputs until the cron job is removed.

Why it was flagged

This is a user-directed cron example that would make the workflow run repeatedly after setup.

Skill content
添加 crontab 自动发送日报:
0 1 * * * cd ~/.openclaw/workspace/projects/literature-collector && ./run.sh
Recommendation

Only add the cron job if you want ongoing automation, and document how to disable it.

What this means

Reports may appear in ClawLib automatically, including any errors or unwanted content in the generated report.

Why it was flagged

Generated reports are automatically copied into another workspace location, which could propagate content if that directory is shared or synced.

Skill content
生成日报后会自动同步到 ClawLib:
- `literature-{date}.md` → `ClawLib/科研日报/`
- `latest.md` → `ClawLib/科研日报/`
Recommendation

Confirm whether ClawLib is shared or synced, and review the generated report before relying on automatic propagation.