Scholarsearch

PassAudited by VirusTotal on May 11, 2026.

Overview

Type: OpenClaw Skill Name: scholarsearch Version: 1.1.0 The 'scholarsearch' skill is a set of instructions for an AI agent to automate academic literature reviews using the Tavily API, PubMed, and Google Scholar. It defines a clear workflow for searching, ranking papers based on clinical relevance, and delivering reports to Obsidian and Feishu. The bundle contains no executable code, suspicious network calls, or malicious prompt-injection attempts, and its behavior is entirely consistent with its stated purpose as a research assistant tool.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

A user or agent might run a local command whose implementation is not included in the reviewed artifact set.

Why it was flagged

The skill documents invoking a local `scholarsearch` command, while the supplied artifacts provide no install spec or code for that command. This is purpose-aligned and user-directed, but its provenance should be verified.

Skill content
`scholarsearch 关键词:房颤,导管消融,脉冲电场消融`
Recommendation

Confirm the source and contents of any `scholarsearch` executable or wrapper before using it, and prefer a pinned, documented installation source.

What this means

If credentials are needed, they could grant access to search APIs or a Feishu workspace depending on how the user configures them.

Why it was flagged

These integrations may involve API keys or account permissions, but the registry metadata declares no primary credential or environment variables. No artifact shows credential leakage or misuse, so this is a setup-scope note.

Skill content
`Tavily API: Academic web search with PubMed/Scholar support` and `Feishu: Daily delivery of complete briefing content`
Recommendation

Use narrowly scoped API tokens or workspace permissions, avoid sharing credentials in prompts, and document how Tavily and Feishu authentication should be provided.

What this means

Search topics and generated literature summaries may be shared outside the local environment with whichever Feishu destination is configured.

Why it was flagged

The skill discloses that complete generated briefings can be sent to Feishu, an external collaboration service, but it does not specify the target chat/channel or workspace boundaries.

Skill content
`Dual delivery: Saves to Obsidian + sends complete content via Feishu`
Recommendation

Configure the Feishu recipient explicitly, review whether the briefing content is appropriate to share, and avoid sending sensitive research topics to broad channels.

What this means

The academic briefings may remain in the user's notes and could influence future work if treated as authoritative without verification.

Why it was flagged

The skill writes generated summaries into a persistent local notes location. The path is scoped and purpose-aligned, but users should remember these generated summaries may be reused or trusted later.

Skill content
`Obsidian: Auto-save to Obsidian 每日学术更新/YYYY-MM-DD.md`
Recommendation

Keep the save path scoped, label generated reports clearly, and verify important citations or medical/scientific claims before relying on them.

What this means

If scheduled, the workflow may repeatedly search, save, and send reports until the schedule is disabled.

Why it was flagged

The skill suggests optional recurring execution. This is disclosed and aligned with morning briefings, but a schedule would let it run and deliver reports without a fresh manual invocation each time.

Skill content
`For automatic scheduling: Use cron or heartbeat to run at 5:00 AM daily`
Recommendation

Only enable cron or heartbeat intentionally, keep logs, set clear stop conditions, and know how to disable the schedule.