Academic Research Conflict

PassAudited by ClawScan on May 1, 2026.

Overview

This skill appears to do what it claims—search scholarly metadata and generate literature reviews—while using external academic APIs and a temporary cache that users should be aware of.

This skill looks safe for ordinary academic searching and literature-review drafting. Before installing, confirm the publisher/package identity because the embedded metadata differs from the registry listing, and be aware that your search terms and DOI lookups may be sent to OpenAlex and Unpaywall and cached temporarily under /tmp/litreview_cache.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The skill may be a copied or repackaged artifact, so the publisher identity is less clear than ideal.

Why it was flagged

The embedded package metadata identifies a different slug and owner than the registry entry shown for the evaluated skill, which creates a provenance/identity mismatch even though the code behavior itself appears purpose-aligned.

Skill content
"ownerId": "kn7d70nbbqsbc4y76x7a6stq3s80e98c", "slug": "academic-research"
Recommendation

Verify that the registry listing, embedded metadata, and publisher are expected before installing or relying on the package.

What this means

Research topics, author names, and DOIs searched through the skill may be visible to external academic API providers.

Why it was flagged

The script sends user research queries and DOI lookups to OpenAlex, and deep-read DOI lookups to Unpaywall. This is aligned with the skill's research purpose, but it is still an external data flow.

Skill content
BASE = "https://api.openalex.org" ... requests.get(f"https://api.unpaywall.org/v2/{paper['doi']}?email={MAILTO}", timeout=10)
Recommendation

Avoid using the skill for confidential research topics unless you are comfortable sharing those queries with the named external services.

What this means

Recent literature-review results may remain on the local machine temporarily.

Why it was flagged

The literature-review script stores retrieved API responses in a local temporary cache for reuse. SKILL.md also discloses this cache, and the cached data appears limited to scholarly API results.

Skill content
CACHE_DIR = Path("/tmp/litreview_cache") ... cache_file.write_text(json.dumps(data))
Recommendation

Clear /tmp/litreview_cache if the searched topic or retrieved paper metadata should not remain locally available.