Target Novelty Scorer

ReviewAudited by ClawScan on May 10, 2026.

Overview

The skill appears non-destructive, but it advertises real PubMed literature mining while the visible implementation generates simulated data, so users could be misled by its scores.

Review this skill before use. Do not rely on its novelty scores for real research decisions unless the maintainer implements and validates real PubMed/PMC retrieval, pins and reconciles dependencies, and clearly documents any API key handling.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI09: Human-Agent Trust Exploitation

What this means

A user could rely on fabricated or random-looking novelty scores for scientific or business decisions.

Why it was flagged

The visible search implementation generates simulated literature counts instead of retrieving PubMed data, which conflicts with SKILL.md's advertised literature mining and can make generated novelty scores appear evidence-based when they are not.

Skill content

"PubMed literature searcher (simulated implementation)" ... "Actual implementation should call NCBI E-utilities API" ... "Here using simulated data for demonstration"

Recommendation

Treat the tool as a demo until real PubMed/PMC retrieval is implemented and validated, or require the documentation and output to clearly label results as simulated.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installation may pull changing package versions or fail to provide the capabilities described in the documentation.

Why it was flagged

The install dependencies are unpinned, and they also do not match SKILL.md's stated dependencies such as requests, pandas, and biopython, indicating incomplete or inconsistent packaging.

Skill content

dataclasses
numpy

Recommendation

Pin dependency versions, reconcile requirements.txt with the documented dependencies, and review package provenance before installation.

Info

#ASI03: Identity and Privilege Abuse

What this means

Users may be unsure what key to provide, where it is stored, or whether it is actually used.

Why it was flagged

The documentation mentions provider API credentials, but the registry metadata declares no required environment variables and the visible code does not show clear credential handling.

Skill content

## API Requirements

- NCBI API Key (for PubMed retrieval)
- Optional: Europe PMC API

Recommendation

Provide only a minimal, service-specific API key if the implementation clearly supports it, and avoid entering unrelated credentials.