arXiv Research Assistant

ReviewAudited by ClawScan on May 1, 2026.

Overview

This appears to be a coherent arXiv research helper, with normal notes around optional MongoDB storage, local PDF downloads, and third-party Python dependencies.

This skill looks reasonable for arXiv research use. Before installing, be aware that it can download PDFs locally, may use MongoDB credentials if you configure them, and relies on third-party Python packages. Use a dedicated limited MongoDB credential and treat retrieved paper text as research content, not assistant instructions.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The assistant can save paper PDFs onto the local filesystem when asked to download papers.

Why it was flagged

The tool can create a local directory and download PDFs to a user-selected path. This matches the advertised download feature, but it is still a local file-write capability users should notice.

Skill content
dl_parser.add_argument("--output", default="./papers", help="Output directory") ... paper.download_pdf(dirpath=output_dir, filename=filename)
Recommendation

Confirm the intended download directory, especially if using shared or synced folders.

What this means

A MongoDB URI provided to the environment may allow the skill to store and update saved-paper records in that database.

Why it was flagged

If a MongoDB connection string is configured, the skill uses that credential to read and write a papers collection for the reading-list feature. This is disclosed and purpose-aligned, but the credential may carry broader database privileges.

Skill content
MONGO_URI = os.getenv('MONGODB_URI', '') ... mongo_client = MongoClient(MONGO_URI) ... self.db.papers.update_one(..., upsert=True)
Recommendation

Use a dedicated MongoDB database or user with minimal permissions for this skill, rather than a broad production credential.

What this means

Future installs could resolve to newer dependency versions than the author tested.

Why it was flagged

The skill depends on third-party Python packages with minimum-version ranges rather than pinned versions. These dependencies are expected for the stated functionality, but version ranges reduce reproducibility.

Skill content
arxiv>=2.0.0
pymongo>=4.0.0
Recommendation

Install from trusted package indexes and consider pinning reviewed dependency versions in controlled environments.

What this means

Paper abstracts or PDFs could contain text that influences an assistant's response if the assistant treats it as authoritative instructions.

Why it was flagged

The skill retrieves external paper metadata and abstracts and may present them to the assistant for analysis. This is central to the research purpose, but retrieved academic text should be treated as untrusted content rather than instructions.

Skill content
"abstract": paper.summary[:500] + "..." if len(paper.summary) > 500 else paper.summary
Recommendation

Treat arXiv content as source material only, and avoid following instructions embedded inside papers or abstracts.