Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Academic Paper Analysis
v1.0.0对学术论文（流行病学、生物统计学方向）进行深度结构化解析。当用户说"分析这篇论文"、"对这篇文献进行分析"、"论文分析"或类似话语时，自动激活此技能。
⭐ 0· 68·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The skill's stated purpose is academic paper analysis, which matches most of the SKILL.md instructions (PDF parsing, detailed methodological commentary). However, the instructions require capabilities not declared in the metadata: they explicitly say to use PyPDF2 in a conda environment and to automatically write extracted table-layout data into a Windows path (D:\autoclaw\结果\医学研究方法库\methods.db). The registry metadata lists no required packages or config paths, so these requirements are inconsistent and unexplained.
Instruction Scope
The SKILL.md directs the agent to read user-supplied PDFs (expected), extract full Abstract and Discussion text, translate them verbatim, and "automatically" extract all table layouts and store them in a database. The automatic writing/storing behavior (without user opt-in at runtime) and the requirement to output full untranslated original text plus complete translations expands the skill's scope beyond simple analysis and could involve storing or redistributing full-text content. The instructions also mandate using a specific library (PyPDF2) and environment (conda) even though those are not declared.
Install Mechanism
There is no install spec (instruction-only), which is low risk in general. However, the SKILL.md explicitly instructs use of PyPDF2 in a conda environment. Because no dependency or install mechanism is declared, it's unclear whether the runtime will have the required tooling. This mismatch is a practical and security concern: the skill will fail or prompt for environment changes, and the author neglected to declare a dependency on a third-party package.
Credentials
The skill declares no required environment variables or credentials, which is proportionate. But it does instruct the agent to create/write to a specific filesystem location (a hard-coded Windows path) and to store data into a local database table. The registry metadata lists no required config paths; this discrepancy is noteworthy because it implies the skill will perform persistent writes to the user's filesystem without those writes being declared or permissioned.
Persistence & Privilege
The skill does not request 'always: true' and is user-invocable (normal). However, the SKILL.md requires automatic extraction of table metadata and storing those records into a persistent DB at a specific path. That is a form of persistent state and requires filesystem write permission. The persistence behavior is not declared in metadata nor does it describe opt-in/opt-out or where else data might be saved or transmitted, which increases risk.
What to consider before installing
What to consider before installing:
- Ask the author to declare dependencies and config paths: The SKILL.md requires PyPDF2 and a conda environment but the registry metadata lists no dependencies. Confirm whether PyPDF2 (or other PDF libraries) will be installed and how.
- Clarify and make storage configurable: The skill hard-codes a Windows path (D:\autoclaw\结果\医学研究方法库\methods.db) for storing extracted table layouts. Ask for a configurable, cross-platform storage location and explicit user consent before writing. Refuse or sandbox the skill until it allows you to opt out of persistent writes.
- Confirm behavior around full-text extraction and translation: The skill mandates returning verbatim Abstract and Discussion sections and full translations. That may have copyright/privacy implications and could mean transferring or storing full paper text. Ask where that data is stored and who can access it.
- Require explicit runtime prompts: The skill says chart/table extraction and DB writes are "automatic". Request that the skill ask for confirmation before performing persistent storage or uploading data externally.
- Verify the source: The homepage points to a GitHub org but the registry source is "unknown." Inspect the repository code (if available) before trusting file-system writes. Because this is instruction-only, a code review may not be possible, so be extra cautious.
- If you must test, run in a sandbox: Execute the skill in an isolated environment (VM or container) where you can safely observe file writes, dependency installation, and network traffic.
What would change this assessment: If the author updates the skill metadata to explicitly declare required packages (PyPDF2), documents and makes configurable the database path (or removes automatic DB writes), and explains any external network endpoints or upload behavior, the inconsistencies would be resolved and the skill could be considered coherent (likely benign).Like a lobster shell, security has layers — review code before you run it.
latestvk970rgks2kajvd5wxvmdadwnyn83gadn
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🔬 Clawdis