Paper Searchv2026.4.9

This plugin appears to implement Semantic Scholar searches and asks only for an optional Semantic Scholar API key (reasonable). However, there are a few inconsistencies that suggest sloppy packaging rather than clear malicious intent: (1) the manifest advertises support for arXiv and PubMed but the code only calls Semantic Scholar, (2) a large ccf-data.json file is bundled but not referenced in the code, and (3) the SKILL.md content is package metadata rather than readable runtime instructions. Recommended actions before installing or enabling: 1) If you require arXiv/PubMed support, ask the author for clarification or a version that implements those sources. 2) If you plan to provide a semanticScholarApiKey, prefer storing it in the plugin config rather than pasting it into chat; confirm how the platform stores plugin config secrets. 3) Because the plugin is enabled by default, consider disabling it until you test a few queries and inspect network calls (they should go only to api.semanticscholar.org). 4) If you need higher assurance, review the index.ts code yourself or request the author to remove unused large data files and fix the SKILL.md to include human-facing instructions. My confidence is medium because the issues look like packaging oversights rather than clear malicious behavior, but these inconsistencies should be resolved first.