WIPO 小分子药物专利周报

ReviewAudited by ClawScan on May 11, 2026.

Overview

The skill has a plausible WIPO report purpose, but it would run missing local helper scripts on a schedule and upload through an undeclared Google Drive rclone profile.

Review and control the local scripts before installing, confirm the rclone `gdrive` account and destination are dedicated to this report, and only enable the weekly cron job if you are comfortable with automatic cloud uploads.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If those local scripts are missing, stale, replaced, or malicious, the skill or scheduled task could fail or run unreviewed code under the user's OpenClaw environment.

Why it was flagged

The core executable helpers are referenced by the workflow, but the supplied artifact set contains no code files or install spec, so the behavior that would actually run is not reviewable here.

Skill content
python3 scripts/wipo_search.py <start_date> <end_date> ... python3 scripts/wipo_generate_report.py wipo_reports/wipo_patent_weekly_<date>.json
Recommendation

Do not enable the skill or cron job until the helper scripts and dependencies are supplied, reviewed, and pinned to a trusted location/version.

What this means

The skill may use whatever Google Drive account is configured as `gdrive` and upload files there during manual or scheduled runs.

Why it was flagged

This uses a local rclone Google Drive remote named `gdrive` and writes to a cloud account, while the metadata declares no credential, required config path, or binary requirement.

Skill content
rclone copy wipo_reports/wipo_patent_weekly_<date>.html gdrive:OpenClaw/专利更新/ --timeout 60s
Recommendation

Use a dedicated, least-privilege rclone remote/account for this task, verify the destination folder, and require clear user consent before enabling scheduled uploads.

What this means

Once configured, it could run every week and upload a report without a fresh user request each time.

Why it was flagged

The skill explicitly describes recurring autonomous execution through cron.

Skill content
也用于 cron 定时任务:每周四 16:30 自动执行。
Recommendation

Only install the cron schedule if you want recurring automation, and keep a clear way to monitor, pause, or remove the job.