Auto Paper Writer

• Verdict: Advisory
• Analyzed: Apr 20, 2026, 1:51 AM
• Findings: 0
• Version: 1.0.0
• Hash: 6aaf80c54c1684878dac417104540b283c774229808b3237de016e87a50e8a64
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: auto-paper-writer Version: 1.0.0 The skill performs high-risk operations including executing PowerShell commands to download external files and running local binaries for LaTeX compilation. A significant concern is found in the cleanup logic of SKILL.md (Step 8), which uses broad wildcards to delete all .ps1 and .py files from the user's desktop, potentially causing unintended data loss. Additionally, the use of hardcoded absolute file paths (e.g., C:\Users\29064\Desktop) suggests the code was tailored for a specific environment or lacks proper input sanitization for general use.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI02: Tool Misuse and Exploitation

ConcernHigh Confidence

What this means

Running the workflow as written could delete unrelated Desktop files, including personal Python scripts, PowerShell scripts, or versioned presentation files.

Why it was flagged

The cleanup command is not scoped to the paper project or files created by the skill. It force-deletes all matching files on the user's Desktop, which can remove unrelated scripts or presentations.

Skill content

Remove-Item "$env:USERPROFILE\Desktop\*.ps1" -Force
Remove-Item "$env:USERPROFILE\Desktop\*.py" -Force
Remove-Item "$env:USERPROFILE\Desktop\*_v*.pptx" -Force

Recommendation

Do not run the cleanup commands as written. Restrict cleanup to a dedicated project/temp folder and delete only files the skill created, preferably after explicit user confirmation.

ASI04: Agentic Supply Chain Vulnerabilities

NoteHigh Confidence

What this means

The workflow may fail or run unexpected local tooling if the user’s environment differs from the hardcoded examples.

Why it was flagged

The instruction-only skill relies on local Python/matplotlib and TeX Live tooling, while the registry metadata declares no required binaries. This is understandable for the stated purpose, but users should verify their local tools and paths before use.

Skill content

使用 matplotlib 生成 300dpi 高质量图片 ... 使用 **TeX Live**（不是 Tectonic）编译

Recommendation

Declare and verify required local tools explicitly, and replace hardcoded paths with user-specific, confirmed paths.