Academic Paper Fetcher
PassAudited by ClawScan on May 1, 2026.
Overview
The skill appears to do what it advertises—download papers from Sci-Hub—but it contacts a third-party site, writes PDFs locally, and has minor dependency/provenance disclosure gaps.
This looks coherent for fetching papers by DOI. Before installing, be comfortable with the skill contacting Sci-Hub, saving PDFs into your workspace, and relying on an undeclared local curl dependency from an unknown publisher.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Providing a DOI can cause the agent to fetch content from Sci-Hub and save a PDF into the workspace.
The skill explicitly contacts Sci-Hub and writes downloaded PDFs locally. This is purpose-aligned, but it is still an external download and local file-write capability users should understand.
2. Navigates to https://www.sci-hub.su/DOI 3. Downloads the PDF 4. Saves to `research/papers/`
Only fetch papers you intend to download, consider legal/compliance requirements, and open downloaded PDFs with normal caution.
Users have less provenance information and may not realize the skill depends on local command-line tooling.
The registry metadata does not provide a verifiable source/homepage and does not declare runtime binary requirements, even though the included helper uses a curl-based implementation. This is a transparency issue, not evidence of malicious behavior.
Source: unknown Homepage: none Required binaries (all must exist): none
Declare curl as a requirement and provide a homepage or source link so users can verify the skill before installing.