academic-paper-citation

学术论文引用自动化处理工具。用于处理中文学术论文（特别是硕士/博士论文）的引用管理工作，包括从Word文档提取内容并转换为Markdown、自动识别和提取参考文献列表、在论文正文中智能插入引用标记、将处理后的Markdown转换回Word格式、扩充论文字数以满足字数要求。适用于需要批量处理引用格式、整理参考文献、...

Security Scan

The skill mostly does what it says (Word↔Markdown, extract/insert citations, expand text), but many scripts hard-code absolute user paths and ignore CLI arguments promised in SKILL.md—this mismatch and the scripts' ability to read/write files in a user's workspace are incoherent and raise privacy/safety concerns.

Purpose & Capability

The name/description align with the included scripts: docx↔md conversion, reference extraction, inserting citation markers, generating abstracts, and expanding text. Node/npm and python requirements mentioned in SKILL.md match the code. One oddity: the skill is labeled 'instruction-only' but ships a large code bundle — not necessarily malicious but worth noting.

Instruction Scope

SKILL.md instructs running scripts with CLI arguments, but many scripts do not actually accept arguments and instead open hardcoded absolute paths under /Users/openclaw2026/.qclaw/workspace/... (read/write). That gives the skill implicit permission to read and overwrite files in that specific user workspace without the explicit filename the user supplied — a scope mismatch and privacy risk.

Install Mechanism

No automated install spec; SKILL.md asks the user to run `npm install docx`. Installing the docx npm package is reasonable for generating .docx files. No downloads from untrusted URLs or archive extraction detected.

Credentials

The skill declares no env vars or credentials, which is appropriate. However, many scripts use absolute filesystem paths to a specific user's workspace and to files like task_status.json, references.json, and output folders. This grants the skill broad local file access (read/write) in that location despite no explicit env/permission model, which is disproportionate relative to a typical citation helper.

Persistence & Privilege

always is false and the skill does not request permanent platform-level privileges. It does write generated files into the user's workspace (its own outputs), which is expected for a document-processing tool. It does not modify other skills or system-wide agent settings.

Scan Findings in Context

[pre-scan-none] expected: Static pre-scan reported no injection signals. That is not evidence of safety—the main concern here is hardcoded absolute paths and file I/O visible in the source files, not obfuscated or networked payloads.

What to consider before installing

This skill appears to implement the advertised features, but inspect and test it carefully before using on real work: - Don’t run these scripts as-is on your primary files. Many scripts have hardcoded absolute paths (/Users/openclaw2026/.qclaw/workspace/...) and will read/write those locations rather than honor CLI args — this can overwrite data unexpectedly. - Review and modify code to accept and respect explicit input/output arguments (or run in a disposable environment). Replace hardcoded paths with relative paths or explicit parameters. - Backup any documents in the referenced workspace before running the skill. Check for files like task_status.json, references.json that the scripts will read — they may contain project metadata. - Run the tool in a sandbox/container or throwaway VM first so you can observe file reads/writes without exposing your real workspace. - The only external install requested is the npm 'docx' package — verify you trust that dependency and install it in an isolated Node environment (nvm, project-local node_modules), not system-wide. - If you plan to allow autonomous invocation, be cautious: although the skill does not exfiltrate data over the network, autonomous runs could read/write many local files due to hardcoded paths. Consider disabling autonomous invocation until you remediate the path-handling issues. If you want, I can: - point out all places in the code that use hardcoded paths so you can patch them, - create a checklist of minimal safe changes to make the scripts accept arguments and avoid surprise file writes, - or suggest a safe wrapper to run the skill in a temporary directory.

学术论文引用自动化处理

本Skill提供一套完整的学术论文引用处理工具链，帮助自动化处理中文学术论文的引用管理工作。

功能概述

1. Word转Markdown: 将.docx论文转换为Markdown格式便于处理
2. 参考文献提取: 自动识别并提取论文中的参考文献列表
3. 引用标记插入: 在论文正文中智能插入引用标记
4. Markdown转Word: 将处理后的Markdown转换回Word格式
5. 论文扩充: 自动扩充论文字数以满足字数要求

使用场景

• 需要为论文添加引用标记但手动操作繁琐
• 需要整理参考文献列表并生成摘要
• 需要扩充论文字数以满足毕业要求
• 需要批量处理多篇论文的引用格式

依赖要求

• Python 3.8+
• Node.js 14+
• npm (用于安装docx库)

安装步骤

1. 解压技能包到OpenClaw技能目录
2. 进入技能目录安装Node.js依赖: npm install docx
3. 重启OpenClaw

工具脚本使用

1. docx_to_md.py - Word转Markdown

python3 scripts/docx_to_md.py <输入.docx> [输出.md]

2. extract_refs.py - 提取参考文献

python3 scripts/extract_refs.py <论文.md>

输出: references.json

3. insert_citations_enhanced.py - 插入引用标记

python3 scripts/insert_citations_enhanced.py <论文.md> <references.json>

4. expand_paper.py - 扩充论文内容

python3 scripts/expand_paper.py <论文.md> [目标字数]

默认目标字数为50000

5. md_to_docx_final.py - Markdown转Word

python3 scripts/md_to_docx_final.py <论文.md> [输出.docx]

6. final_check.py - 质量检查

python3 scripts/final_check.py <原始.md> <处理后.md>

完整工作流程

# 1. Word转Markdown
python3 scripts/docx_to_md.py 论文初稿.docx

# 2. 提取参考文献
python3 scripts/extract_refs.py 论文初稿.md

# 3. 生成文献摘要
python3 scripts/generate_abstracts.py 论文初稿.md references.json

# 4. 插入引用标记
python3 scripts/insert_citations_enhanced.py 论文初稿.md references.json

# 5. 扩充论文内容（如需要）
python3 scripts/expand_paper.py 论文初稿_citations_enhanced.md 50000

# 6. Markdown转Word
python3 scripts/md_to_docx_final.py 论文初稿_final.md 论文终稿.docx

# 7. 质量检查
python3 scripts/final_check.py 论文初稿.md 论文初稿_final.md

引用标记格式

使用Markdown上标格式标记引用：

银行核心系统的技术演进与信息技术发展密切相关[4]。

转换为Word后显示为上标格式。

参考文献格式支持

• [J] 期刊论文
• [M] 专著/书籍
• [D] 学位论文
• [C] 会议论文
• [R] 研究报告
• [Z] 标准/规范

技术实现细节

详细实现算法和扩展方法请参阅 references/implementation.md

注意事项

1. 引用格式: 默认使用 [n] 上标格式，如需其他格式请手动调整
2. 字数统计: 中文字符数约等于字数，英文按单词计算
3. 格式兼容性: 生成的Word文档使用标准OOXML格式
4. 备份建议: 处理前建议备份原始文档