Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Research Report Generator

v1.0.0

Research technical projects/papers and generate comprehensive reports with PDF export. Modes: lite (analysis + writing) or full (+ environment setup + experi...

0· 696·6 current·6 all-time
byYuno Wang@huaruoji
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
high confidence
Purpose & Capability
Name/description (research report generation, PDF export, lite/full modes) matches the provided bash scripts: they create drafts, optionally read a local project path, generate PDFs via pandoc or a local md2pdf skill, and record logs. Minor mismatch: SKILL.md describes remote literature search and 'send to user via Telegram', but the scripts do not perform network fetches or any Telegram send; they only create local notes and read local files. Overall requirements (pandoc) are proportional.
!
Instruction Scope
SKILL.md instructs broad runtime behavior (search arXiv, fetch related papers, identify dependencies, 'Code reading (local or remote)') but the scripts implement only local-note creation, listing/finding local files, drafting iterative markdown files, and optional pandoc-based PDF conversion. 'Full mode' claims dependency install and experiment execution, but the script explicitly warns that full mode requires manual intervention and does not perform conda/CUDA installs or run experiments automatically. There is also an unimplemented note about sending the PDF via Telegram present in SKILL.md but not in scripts. The instruction doc therefore over-promises capabilities that are not implemented in the code.
Install Mechanism
No install spec and only two small shell scripts + markdown templates are included. There are no downloads, archive extracts, or external installers declared. This is the lower-risk, instruction-only / lightweight script distribution model.
Credentials
Declared runtime requirement is pandoc (and mentions texlive-xetex for full PDF rendering). The skill requests no credentials or secret environment variables. It writes under a workspace directory (default: ~/.openclaw/workspace-research) and appends to a per-day memory file; these are proportionate to a report generator. It does reference $HOME and optional --project-path (local path) — neither are excessive, but note that supplying a project path points the tool at local code.
Persistence & Privilege
always:false (no forced inclusion). The scripts create files under the workspace and append to a memory file, but they do not modify other skills' configs or system-wide settings. The skill checks for a local md2pdf script path under $HOME and will call it if present; this is contained and expected.
What to consider before installing
This skill appears to be a lightweight, local report generator implemented as bash scripts — not a full autonomous research agent. Before installing or running it: - Understand what it actually does: the scripts create iterative Markdown drafts, list (but do not fetch) local project files, and convert Markdown to PDF locally with pandoc or an existing md2pdf skill. They do not perform web searches, download papers, perform automated experiments, nor send PDFs via Telegram despite those claims in SKILL.md. - If you plan to provide --project-path pointing to a local repo, be cautious: the skill will read files under that path (find -type f) and will create logs and report files in your workspace. It does not execute user code, but if you later run 'full' experiments manually you may execute untrusted code — do that in an isolated environment. - Verify the md2pdf path and pandoc availability on your system; the script will call $HOME/.openclaw/skills/md2pdf/scripts/md2pdf.sh if present, otherwise it invokes pandoc directly. - Because the documentation over-promises (remote fetching, Telegram delivery, automated experiments) but the code does not implement those steps, treat the skill as partial/incomplete. If you need the claimed features, request or inspect additional code that implements them. If you accept the current behavior, run the scripts in a controlled workspace (or container) and review the created files/logs afterward. - If you want to proceed but are security-conscious: run the scripts in a throwaway or sandboxed account/container and inspect the output and created files before granting broader access.

Like a lobster shell, security has layers — review code before you run it.

latestvk970skfvvqycth0c2gdg1s4yj981mqs4

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Runtime requirements

📝 Clawdis
Binspandoc

Comments