Literature Review

• Analyzed: May 12, 2026, 3:03 AM
• Findings: 1
• Version: 1.2.0
• Hash: 5ffabf4988caaeec8d2a5953fe793fc9f057db099dd35c34b98518f9f5df773b
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is benign. It provides a tool for searching academic databases (Semantic Scholar, OpenAlex, Crossref, PubMed) via their public APIs. The `scripts/lit_search.py` script uses environment variables (`SEMANTIC_SCHOLAR_API_KEY`, `OPENALEX_API_KEY`, `USER_EMAIL`, `CLAWDBOT_EMAIL`) for legitimate API authentication and identification, not for exfiltration. All network requests are directed to the stated academic API endpoints. There is no evidence of malicious execution, data exfiltration to unauthorized destinations, persistence mechanisms, obfuscation, or prompt injection attempts in `SKILL.md`.