论文阅读助手

PassAudited by ClawScan on May 10, 2026.

Overview

This appears to be a coherent paper-reading skill, but it can install PDF libraries at runtime and cache extracted paper content locally.

This skill looks suitable for its stated purpose. Before installing, be aware that it may install PDF parsing libraries automatically and cache extracted paper content locally; use an isolated Python environment and clear the cache if you analyze private documents.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Running the skill may download and install third-party Python packages into the active Python environment.

Why it was flagged

The skill automatically installs runtime dependencies such as pymupdf, pdfplumber, and pypdf without pinned versions. This is disclosed and relevant to PDF extraction, but it introduces normal package supply-chain risk.

Skill content

subprocess.check_call([sys.executable, '-m', 'pip', 'install', package_name, '-q', '--disable-pip-version-check'])

Recommendation

Use a virtual environment or preinstall reviewed, pinned versions of the PDF libraries before using the skill.

Low

#ASI06: Memory and Context Poisoning

What this means

Extracted paper content or metadata may persist locally and be reused on later runs.

Why it was flagged

The skill stores extracted paper analysis data in a persistent local cache. This is purpose-aligned and disclosed, but private or unpublished papers may remain on disk after analysis.

Skill content

CACHE_DIR = Path.home() / ".workbuddy" / "cache" / "readpaper" ... json.dump(data, f, ensure_ascii=False, indent=2)

Recommendation

Avoid using sensitive PDFs unless local caching is acceptable, or delete ~/.workbuddy/cache/readpaper after use.