Google Scholar Search Skill

PassAudited by ClawScan on May 1, 2026.

Overview

The skill appears to do the advertised Google Scholar searching, with normal but noticeable network scraping, file-output, and user-directed dependency installation considerations.

This skill looks consistent with a Google Scholar search/export tool. Before installing, review the remote install and dependency commands, and when using it, avoid sensitive search queries and choose output filenames that will not overwrite important files.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Your search terms may be sent to Google Scholar, and an output file could overwrite an existing file if you choose that path.

Why it was flagged

The tool sends user search terms to Google Scholar and can write results to a user-provided file path. This is expected for the stated search/export purpose, but it is still external network use and local file mutation.

Skill content
response = requests.get(search_url, headers=self.headers, timeout=10) ... with open(filepath, 'w', encoding='utf-8') as f:
Recommendation

Use non-sensitive search terms when appropriate and save exports to a dedicated, non-critical filename or folder.

What this means

Installing the skill or dependencies from remote sources can run code supplied outside the registry artifacts.

Why it was flagged

The README provides user-directed installation commands that fetch code or installers from the network and install Python dependencies. This is common for a Python skill, but it relies on external sources.

Skill content
npx skills add https://github.com/JackKuo666/google-scholar-search-skill.git ... curl -LsSf https://astral.sh/uv/install.sh | sh ... pip install -r requirements.txt
Recommendation

Review the repository and dependency list before installation, prefer trusted environments, and avoid running remote installer commands unless you trust the source.