Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Gemini Citation

Conduct evidence-based research with exact, accurate APA citations using the Gemini API's 'scientific citation' (Google Search grounding) feature. Use when X...

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 36 · 0 current installs · 0 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The SKILL.md and the included Python script consistently implement a Gemini 'search grounding' research tool that requests APA citations; this aligns with the skill name and description. However, the registry metadata declares no required environment variables or primary credential while both the SKILL.md and script require GEMINI_API_KEY, which is an incoherence in the packaging.
Instruction Scope
Runtime instructions are scoped to calling the Gemini API with search grounding, formatting APA citations, and printing grounding sources. The script only reads the GEMINI_API_KEY env var and the user query; it does not reference other files, system paths, or unrelated environment variables.
Install Mechanism
There is no formal install spec (instruction-only), and SKILL.md instructs users to pip install the public 'google-genai' package. That is a reasonable approach, but the skill does not include a pinned package version or verification guidance for the pip dependency.
!
Credentials
The script and SKILL.md require GEMINI_API_KEY, but the registry metadata lists no required env vars and no primary credential. A required secret is effectively undocumented in the package manifest — this is disproportionate/inconsistent and should be corrected. Confirm that only a single Gemini API key is needed and that no other credentials are requested.
Persistence & Privilege
The skill does not request persistent privileges (always is false), does not modify other skills or system settings, and does not persist credentials itself. It behaves like a normal, non-persistent CLI helper.
What to consider before installing
This skill appears to do what it says (call Gemini/Google Search grounding and produce APA citations), but the package metadata fails to declare the required GEMINI_API_KEY. Before installing or running: (1) verify the GEMINI_API_KEY is the only secret required and that you trust the owner (no homepage provided); (2) install the 'google-genai' package in an isolated environment and prefer a pinned version; (3) review the script yourself (it is short and included) to confirm it only sends queries to the Gemini API and prints responses; (4) restrict the API key scope and rotate it if possible; and (5) if you will run this in environments with sensitive network access, consider running the tool in a sandbox or VM. The omission in the manifest is likely a packaging oversight but worth clarification from the publisher before granting credentials.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.1
Download zip
latestvk97c85wxfy2ty7b8c30dx28hpx836tmc

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

Gemini Citation

Overview

This skill leverages the Gemini API's Google Search Grounding feature to return heavily factual, exact evidence directly tied to search results, along with properly formatted APA inline and trailing citations. It guarantees that generated facts are grounded in live web references rather than model hallucinations.

Quick Start

You can use the provided script to query the Gemini API with search grounding enabled.

1. Requirements

Ensure the GEMINI_API_KEY is set in your environment and the google-genai package is installed:

export GEMINI_API_KEY="your-api-key"
pip install google-genai

2. Running a Research Query

Execute the gemini_cite.py script with your research topic. The script automatically forces the Gemini API to use Google Search Grounding and requests strict APA formatting.

python scripts/gemini_cite.py "Recent breakthroughs in solid-state battery technology"

To see structured JSON output containing the exact source titles and URIs used by the model:

python scripts/gemini_cite.py "Recent breakthroughs in solid-state battery technology" --format json

How It Works

  1. Google Search Grounding: The API call is configured with tools=[{"google_search": {}}]. This forces the model to fetch live information before generating a response.
  2. Strict APA Instructions: The script's prompt injects an explicit requirement to use "Author, Year" inline citations and to list all references in proper APA format at the end.
  3. Grounding Metadata Verification: The script extracts the grounding_chunks from the Gemini API response metadata and displays the exact source URLs and titles that the model used, ensuring that you have an auditable list of sources alongside the generated APA citations.

When to Use

  • Literature Reviews: When Xiaoyan is tasked with gathering current state-of-the-art information on a technical or scientific topic.
  • Fact-Checking: When you need exact evidence and verifiable URLs rather than general knowledge.
  • Academic Writing: When strict APA formatting and inline citations are a requirement for the final output.

Resources

scripts/

  • gemini_cite.py: A Python CLI tool that handles the Gemini API call, enables Google Search grounding, enforces APA citations, and parses the grounding metadata to output verifiable source links.

Advanced Usage

If you prefer to write your own API scripts, the core pattern for enabling exact citations with google-genai is:

from google import genai
from google.genai import types

client = genai.Client()
response = client.models.generate_content(
    model='gemini-2.5-pro',
    contents='Your research query here...',
    config=types.GenerateContentConfig(
        tools=[{"google_search": {}}]
    )
)

# Access sources
for chunk in response.candidates[0].grounding_metadata.grounding_chunks:
    print(chunk.web.title, chunk.web.uri)

Files

3 total
Select a file
Select a file to preview.

Comments

Loading comments…