ArXiv Research
AdvisoryAudited by Static analysis on Apr 30, 2026.
Overview
No suspicious patterns detected.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Installing the skill may require installing a third-party Python package, so the behavior depends partly on that package and the package source.
The skill depends on the external `arxiv` Python package installed from PyPI. This is expected for the stated purpose, but the dependency is not pinned to a specific version.
metadata: {"openclaw": {"emoji": "📚", "requires": {"bins": ["python"], "pip": ["arxiv"]}, "homepage": "https://arxiv.org"}}
...
pip install arxivInstall dependencies from a trusted Python environment and consider pinning or reviewing the `arxiv` package version if used in sensitive environments.
Using the download feature will create files on the user's machine under the Downloads folder.
The download command creates a local directory and saves PDFs there. This is disclosed and purpose-aligned, but it is still a local file-writing capability.
download_dir = os.path.join(os.path.expanduser("~"), "Downloads", "arxiv")
os.makedirs(download_dir, exist_ok=True)
...
path = paper.download_pdf(dirpath=download_dir, filename=f"{arxiv_id}.pdf")Use the download command only for intended papers and periodically review the download folder if storage or file provenance matters.