Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Asta Skill

v0.2.7

Domain expertise for Ai2 Asta MCP tools (Semantic Scholar corpus). Intent-to-tool routing, safe defaults, workflow patterns, and pitfall warnings for academi...

1· 164·0 current·0 all-time
byAgents365.ai@agents365-ai

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for agents365-ai/asta-skill.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Asta Skill" (agents365-ai/asta-skill) from ClawHub.
Skill page: https://clawhub.ai/agents365-ai/asta-skill
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: ASTA_API_KEY
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install asta-skill

ClawHub CLI

Package manager switcher

npx clawhub@latest install asta-skill
Security Scan
Capability signals
CryptoCan make purchasesRequires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name, description, and declared requirements align: the skill is an instruction pack for Ai2's Asta MCP tools and only requires ASTA_API_KEY (used as the x-api-key header to the Asta MCP server). No unrelated binaries, credentials, or platform access are requested.
Instruction Scope
SKILL.md stays within the scope of guiding MCP usage, intent→tool routing, safe defaults, and workflows. One inconsistency: the header claims "The skill does not make HTTP calls itself," yet the Update Notifications section instructs the agent to fetch https://raw.githubusercontent.com/.../SKILL.md to check versions and to write a .last_version_check file in the skill directory. The update-check is a limited external fetch for version metadata and writing a local timestamp; this is not required for Asta functionality but is a documented optional behavior.
Install Mechanism
Instruction-only skill (no install spec, no code files to execute). Installation guidance is limited to cloning the repo into normal skill directories. No remote installers, archived downloads, or executables are installed by the skill itself.
Credentials
Only one environment variable is required: ASTA_API_KEY, which directly corresponds to the Asta MCP x-api-key header — proportional and expected for this integration. No additional secrets or unrelated credentials are requested.
Persistence & Privilege
The skill is not force-included (always:false). It requests only permission to write a small per-skill file (.last_version_check) in its own directory for optional update-notifications; it does not request system-wide config changes or other skills' credentials. The agents/openai.yaml allows implicit invocation (allow_implicit_invocation: true), which means the skill can be triggered automatically by the host when relevant — this is typical for skills but users should be aware of it.
Assessment
This skill is coherent and appears to do what it says: it helps agents use Ai2's Asta MCP tools and only needs your ASTA_API_KEY. Before installing: (1) ensure you trust the ASTA API key destination and that you store ASTA_API_KEY in a secure place (environment variables are typical); (2) be aware the skill can be implicitly invoked by the host when you ask about papers/citations; (3) if you want to avoid any outbound network fetches beyond the Asta MCP server, note the SKILL.md documents an optional update-check that fetches a SKILL.md from raw.githubusercontent.com and writes a .last_version_check file — you can disable or ignore that behavior or inspect/implement it on the host side; (4) if you need stricter isolation, confirm your host enforces MCP server registration and does not allow arbitrary outbound calls by skills. Overall: safe to install if you trust the Asta/Allen AI endpoint and the ASTA_API_KEY request.
README_CN.md:82
User-controlled placeholder is embedded directly into generated source code.
README.md:82
User-controlled placeholder is embedded directly into generated source code.
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🔭 Clawdis
EnvASTA_API_KEY
latestvk97dgagkj3r15p9q8dw02kegcs85f18h
164downloads
1stars
5versions
Updated 3d ago
v0.2.7
MIT-0

Asta MCP — Academic Paper Search

Asta is Ai2's Scientific Corpus Tool, exposing the Semantic Scholar academic graph over MCP (streamable HTTP transport). This skill tells agents which Asta tool to call for which intent, and how to compose them into useful workflows.

Update Notifications

If <skill_directory>/.last_version_check is missing or >24h old, fetch the version from https://raw.githubusercontent.com/Agents365-ai/asta-skill/main/SKILL.md, compare to the local version, then write the current Unix timestamp to .last_version_check. If remote is newer, tell the user once: 📢 asta-skill X.Y.Z → A.B.C. Run 'git -C <skill_directory> pull' to update. Silently skip on any failure. Never run git pull yourself.

Prerequisite Check

Before invoking any tool, verify the Asta MCP server is registered in the host agent. Tool names will be prefixed by the MCP server name chosen at install time (commonly asta__<tool> or mcp__asta__<tool>). If no Asta tools are visible, direct the user to the Installation section below.

Tool Map — Intent → Asta Tool

User intentAsta toolNotes
Broad topic searchsearch_papers_by_relevanceSupports venue + date filters
Known paper titlesearch_paper_by_titleOptional venue restriction
Known DOI / arXiv / PMID / CorpusId / MAG / ACL / SHA / URLget_paperSingle-paper lookup
Multiple known IDs at onceget_paper_batchBatch lookup — prefer over N sequential get_paper calls
Who cited paper Xget_citationsCitation traversal with filters, paginated
Find author by namesearch_authors_by_nameReturns profile info
An author's publicationsget_author_papersPass author id from previous call
Find passages mentioning Xsnippet_search~500-word excerpts from paper bodies

Search/citation tools accept publication_date_range (format YYYY-MM-DD:YYYY-MM-DD; year shorthand like "2021:", ":2015-01", "2015:2020" is also accepted) and venues (comma-separated) filters, plus fields for field selection — pass them whenever the user's intent constrains scope (e.g., "recent", "since 2022", "at NeurIPS").

⚠️ fields parameter — avoid context blowups

get_paper / get_paper_batch accept a fields string. Never request citations or references via fields — a single highly-cited paper (e.g. Attention Is All You Need) returns 200k+ characters and will overflow the agent's context window. Use the dedicated get_citations tool for forward citations (it paginates). Asta does not provide a dedicated get_references tool — to retrieve a paper's reference list, use get_paper with fields=references only for papers you know have a small reference list (typically < 100).

Safe default fields for get_paper:

title,year,authors,venue,tldr,url,abstract

Add journal, publicationDate, fieldsOfStudy, isOpenAccess only when needed.

Workflow Patterns

Pattern 1 — Topic Discovery

  1. search_papers_by_relevance(keyword, publication_date_range="<current_year-5>:", venues=?) → initial hits (compute the lower bound from today's date — e.g., in 2026 pass publication_date_range="2021:"; adjust or drop the filter if the user asks for older work)
  2. Rank/present top N by citationCount + recency
  3. Offer follow-ups: get_citations on the most influential, or snippet_search for specific claims

Pattern 2 — Seed-Paper Expansion

  1. get_paper(DOI|arXiv|...) → verify seed
  2. get_citations(paperId) → forward expansion
  3. Optionally search_papers_by_relevance with seed title terms for sideways discovery
  4. Deduplicate by paperId before presenting

Pattern 3 — Author Deep-Dive

  1. search_authors_by_name(name) → pick correct profile (disambiguate by affiliation)
  2. get_author_papers(authorId) → full publication list
  3. Filter client-side by topic keywords or date

Pattern 4 — Evidence Retrieval

  1. snippet_search(claim_query) → find passages making/supporting a claim
  2. For each hit, optionally get_paper(id) for full metadata

Output & Interaction Rules

  • Always report total count and which tool was used.
  • Present top 10 as a table (title, year, venue, citations), then details for the most relevant.
  • If the user writes in Chinese, present summaries in Chinese; keep titles in original language.
  • After results, offer: Details / Refine / Citations / Snippet / Export / Done.

Critical Rules

  • Prefer batched intent over ping-pong. If the user's question needs two independent lookups, issue them as parallel MCP tool calls in one turn, not sequentially.
  • Never guess IDs. If a user gives a fuzzy title, use search_paper_by_title before get_paper.
  • Respect rate limits. An API key buys higher limits but not unlimited — stop expanding citation graphs beyond what the user asked for.
  • Do not fabricate fields. If Asta returns null abstract or venue, say so rather than inventing.

Handling Asta responses

SituationWhat to do
Empty abstractNot all corpus papers have full text — use snippet_search, or fall back to title + TLDR
Author disambiguation uncertainInspect affiliations in search_authors_by_name results before calling get_author_papers
429 Too Many RequestsBack off; batch with get_paper_batch instead of sequential get_paper calls

Comments

Loading comments...