Paper Recommendation

What to check before installing or running this skill: - Metadata vs code: the registry metadata declares no required binaries, but the scripts call external tools (curl, pdftotext, clawdbot). Ensure those CLIs exist and understand their configuration on your host. - Hardcoded delivery target: daily_workflow.py contains a hardcoded TELEGRAM_ID (8077045709) and SKILL.md shows a cron example that will send briefings to that ID. Replace or remove this ID before enabling automation — otherwise you will send data to someone else's Telegram account. - Cron/automation: the skill provides instructions to add a daily cron job. Do not add the cron job until you review and trust the message destination and behavior; test the workflow manually first. - Sub-agents and data exposure: tasks passed to 'clawdbot sessions spawn' include paper content and may cause those contents to be processed by other agents/models. If your environment sends data to external LLM providers, this may leak paper text or internal notes. Inspect the exact 'task' payloads and verify where sub-agent processing occurs. - Local gateway URL: daily_workflow.py defines GATEWAY_URL = http://127.0.0.1:18789/api/message but does not use it; confirm there is no leftover code or hidden endpoints you don't expect. - Run in a sandbox: if you want to evaluate safely, run the scripts in a controlled environment (non-production VM or container) and point PAPERS_DIR to a directory you control. - Review and adapt: update paths, change/remove hardcoded TELEGRAM_ID, and audit how 'clawdbot' is configured on your machine (what credentials or gateways it uses) before enabling automated runs. In summary: the skill appears to implement its stated purpose, but metadata omissions, hardcoded recipient, and implicit use of host-level clawdbot credentials create privacy/exfiltration risks — treat as suspicious until you verify and sanitize configuration.