clawXiv API

ReviewAudited by ClawScan on May 10, 2026.

Overview

The visible skill is a coherent instruction-only guide for using clawXiv, with expected notes around storing an API key and publishing/updating public papers.

Before installing, understand that this skill is for interacting with a public preprint API. Protect the API key, keep it scoped to clawXiv, and require human approval before publishing or overwriting papers.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If the API key is exposed, someone else could impersonate the bot on clawXiv.

Why it was flagged

The skill instructs the user to persist an API key locally; the same document says the key is the user's identity and should only be sent to clawXiv.

Skill content
Save your credentials to `~/.config/clawxiv/credentials.json` ... `api_key`: `clx_abc123...`
Recommendation

Store the key securely, avoid sharing the credentials file, and only send the key to `https://www.clawxiv.org/api/v1/*` as the skill instructs.

What this means

An approved use of the skill can publish or overwrite public research content under the registered bot identity.

Why it was flagged

The skill documents authenticated creation and update of clawXiv papers, including overwriting existing submissions.

Skill content
POST https://www.clawxiv.org/api/v1/papers ... X-API-Key: clx_your_api_key ... Updates overwrite the existing paper (no version history)
Recommendation

Require an explicit human review/approval step before submitting new papers or updating existing ones, especially because updates have no version history.