Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Deep Research Pro v2.1

v2.1.0

Conducts stepwise in-depth research by generating detailed source cards with data, quotes, quality scores, cross-analyzing findings, and producing fully cite...

0· 130·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description (in-depth research) aligns with required actions: querying OpenAlex, web browsing, generating source cards, cross-analysis, and a final report. Tools mentioned (OpenAlex, web browsing, local quality-score script, filesystem write/read) are appropriate for the stated purpose.
!
Instruction Scope
SKILL.md enforces heavy file I/O (creating many directories/files) and demands long direct quotes (>=50 words) and storing them in source cards — this may cause copyright/exposure concerns and is a broad data-collection behavior. There are concrete mismatches: the quality-score.py script expects a JSON input (python3 quality-score.py <source_json>) but SKILL.md and templates produce markdown card files; other files disagree on minimum source counts (SKILL.md: deep mode >=15 cards, QUALITY_CRITERIA.md and RESEARCH_PROTOCOL.md: total sources >=20). These inconsistencies could cause runtime failures or unexpected skipping of steps.
Install Mechanism
Instruction-only skill with no install spec and no external downloads; included Python script is local. This is low install risk — nothing will be fetched from arbitrary URLs or installed system-wide.
Credentials
The skill requests no environment variables, no credentials, and declares no config paths. Network usage (OpenAlex API and web browsing) is consistent with research purpose and doesn't require secret access. No unexplained credential requests found.
Persistence & Privilege
Skill writes numerous files to the agent workspace (research/, sources/, analysis/, reports/) and preserves generated cards across runs (per SKILL.md). always:false and default autonomous invocation are in place; autonomous invocation combined with persistent filesystem writes is expected here but means the skill can create/retain sizable data on disk — users should be comfortable with that.
What to consider before installing
This skill broadly does what it says (deep research and producing source cards), but several internal inconsistencies and operational risks should be resolved before use: - Fix format mismatch: scripts/quality-score.py expects JSON input but templates and SKILL.md produce markdown source cards. Either convert card files to JSON before scoring, adjust the script to parse the markdown frontmatter, or change the templates to emit JSON. Without this, the quality-check step will fail. - Reconcile source-count requirements: different files mention 15 vs 20 required sources. Decide on a single requirement and update SKILL.md, QUALITY_CRITERIA.md, and RESEARCH_PROTOCOL.md to match; otherwise the self-checks may block report generation. - Be aware of data/exposure and copyright: the skill requires copying at least one direct quote of >=50 words from each source into local cards. That may reproduce copyrighted text; consider extracting paraphrases or storing citation metadata rather than long verbatim quotes. - File-system impact: the skill will create and retain many files. Confirm you trust the workspace and are OK with persistent local data (including possibly scraped content from the web). - Operational testing: run a dry test on non-sensitive topics to confirm the workflow and script behavior. If you rely on automatic quality scoring, ensure the scoring script's assumptions about input format and fields (publication_year, sample_size, etc.) match your card data. If these issues are fixed (script/template alignment, unified requirements, and a clear policy about quoting/copyright), the skill appears coherent and usable. As-is, it's more likely to fail or behave unexpectedly, so proceed only after remediation or with caution.

Like a lobster shell, security has layers — review code before you run it.

deepvk970pnhpw4n3etw4n0ycscakc5836j57enforcedvk970pnhpw4n3etw4n0ycscakc5836j57latestvk970pnhpw4n3etw4n0ycscakc5836j57researchvk970pnhpw4n3etw4n0ycscakc5836j57studyvk970pnhpw4n3etw4n0ycscakc5836j57

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Comments