Arxiv Cli Tools

• Risk level: Low
• Analyzed: May 1, 2026, 5:34 AM
• Findings: 1
• Version: 0.0.1

Overview

This skill coherently documents a user-directed arXiv search/download CLI, with the main caution being that it asks users to install an external PyPI package.

This appears safe for its stated purpose. Before installing, confirm that the PyPI package `arxiv-cli-tools` is the one you intend to use; using `pipx` is preferable because it isolates the CLI from your main Python environment.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI04: Agentic Supply Chain Vulnerabilities

Note

What this means

Installing the package will trust code from PyPI under that package name.

Why it was flagged

The skill instructs users to install an external PyPI package, and the artifact set does not include the package code or a pinned version. This is common for CLI tools and aligned with the stated purpose, but it is still a supply-chain point users should notice.

Skill content

pipx install arxiv-cli-tools
...
pip install arxiv-cli-tools

Recommendation

Prefer pipx, verify the PyPI project and maintainer before installing, and consider pinning a known version if reproducibility matters.