paper claw
v1.0.0Fetch, classify, and summarize papers from multiple sources (arXiv, etc.) with AI-powered multi-language summaries and email delivery.
⭐ 1· 223·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (fetch, classify, summarize, email) align with requested items: python3, SMTP credentials for delivery, and optional LLM API keys for summaries. Presets and config-write behavior are appropriate for a configurable digest generator.
Instruction Scope
Runtime instructions and example code operate on the skill's own files (config/, scripts/, data/, content/) and invoke scripts/main.py via subprocess — expected for this tool. Important note: the skill sends content to external services when optional LLM API keys are provided and will transmit digests via the configured SMTP server, so paper content may be shared with third-party LLM providers and recipients. Recommend reviewing scripts/main.py, email templates, and any network calls before enabling in a sensitive environment.
Install Mechanism
Instruction-only skill with no install spec and only a Python runtime requirement. No downloads or archive extraction; low install risk.
Credentials
Required env vars are limited to SMTP_HOST/PORT/USER/PASS for email delivery — directly justified by the email delivery feature. Several optional API keys (OpenAI, Anthropic, Gemini, DeepSeek, etc.) are declared and justified for multi-provider LLM summarization. No unrelated secrets or surprising credential requests are present.
Persistence & Privilege
Skill is not always-enabled, uses normal agent invocation, and only writes/updates configuration files under its own skill directory (config/default.json, config/recipients.json). It does not request system-wide privileges or modify other skills.
Assessment
This skill appears to do what it says: fetch arXiv papers, classify/summarize them, and email digests. Before installing: 1) Review scripts/main.py and any network calls to confirm what data is sent to external LLM providers. 2) Use an app-specific or limited-outbound SMTP account (not your primary personal/work mailbox) until you trust the tool. 3) If you will provide optional LLM API keys, be aware that paper abstracts/full text may be transmitted to those vendors. 4) Inspect the GitHub Actions workflow and any scheduled cron/task entries before enabling automatic runs to avoid unexpected outgoing emails or network activity. 5) Ensure Python and listed dependencies (requests, feedparser, dateutil, jinja2) are acceptable for your environment.Like a lobster shell, security has layers — review code before you run it.
latestvk9737z4ywm04vxk6zkg41vpxns82tn9d
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📰 Clawdis
Binspython3
EnvSMTP_HOST, SMTP_PORT, SMTP_USER, SMTP_PASS