ynu-papergraphgeneration-qclaw

Key things to consider before installing or running this skill: - Network/data exfiltration: The skill sends topology/prompt text (derived from your paper) to an external image API (api.acedata.cloud by default). If your paper is confidential/unreleased, this will leak its content to that third party unless you run the skill offline or point it to a private service. - Hardcoded API key: The repository contains a DEFAULT_API_KEY constant. Embedded keys in code are a red flag: ask the publisher for provenance of this key, remove it, or ensure the skill accepts an API key from a secure environment variable before use. - Execution of generated code: For 'results' figures the skill asks an LLM to emit full Python/Matplotlib code and then writes and runs that code via subprocess. LLM-generated code can be arbitrary and may perform malicious actions. Run the skill only in a sandboxed environment or disable automatic execution and review generated code manually. - Missing/incorrect overrides: The SKILL.md lets you pass api_url but not an api_key; the image-generation code also contains a positional-argument bug that can incorrectly map parameters. Expect potential runtime errors or unexpected behavior; review and test the code on non-sensitive inputs first. - Files written to disk: Outputs are placed under ~/.qclaw/workspace/outputs. If this is undesirable, change the path or run in a disposable environment. Recommended actions: - Request the author to (1) remove hardcoded credentials and accept API keys via environment variables, (2) document data flows and privacy implications, and (3) avoid executing untrusted code (or add a strict sandbox/safety checks). - If you must use it, run it on a throwaway VM/container, with network firewall rules if you want to prevent external API calls, and inspect any generated chart code before executing it. Confidence note: I am confident the above concerns are real based on the included files; additional context from the package author (why key was embedded, intended deployment environment, or a fixed bug in parameter passing) could change the assessment.