Adaptive Depth Research v6.0 Universal

What to consider before installing/using: - Function vs requirements: The skill does what it says (download/search papers, parse PDFs, build reports). However the package metadata does NOT list required runtime dependencies (python3, requests, and either pdfplumber or pdftotext). Install these from known sources before running. - Network and file I/O: Scripts make outbound HTTP(S) calls to arXiv, NCBI/PMC, PubMed eutils and arbitrary URLs you pass. They download PDFs and write to /tmp and a research/ workspace. Only run in an environment where outbound network requests and temporary file writes are acceptable (use a sandbox or isolated VM for initial testing). - Input-driven fetching (SSRF risk): Because URLs and search terms may lead the tool to fetch arbitrary endpoints, do not run untrusted topics/URLs. If an attacker can control inputs, the tool could be induced to access internal services or fetch malicious content. Validate inputs and run in a network-restricted environment if you need to limit that risk. - Missing dependency and doc gaps: The skill should document Python package requirements and any rate-limit/API-key expectations for Entrez/eutils. Consider adding a requirements.txt or Dockerfile and clarifying expected runtime paths. - Hardcoded path: run-research.sh calls a check-sourcing script via an absolute path (/root/.openclaw/...), which is unusual and may fail or indicate assumptions about the host environment. Inspect and if needed, adjust the path to refer to the skill-relative script (scripts/check-sourcing.sh) before running. - Legal/compliance: The skill attempts to download PDFs and may attempt paywalled content; ensure you have rights to fetch and store copyrighted material and that you comply with terms of use for third-party services. - Practical steps before running: 1) Review scripts locally and run in an isolated sandbox/VM. 2) Install dependencies from trusted package sources (pip install requests pdfplumber or pdftotext). Prefer pinning versions. 3) Replace the absolute /root/.openclaw path with the relative skill path if necessary. 4) Limit network access if you want to prevent the skill from reaching internal endpoints. 5) If you expect heavy Entrez usage, add an NCBI API key and rate-limit handling. Overall: the skill appears coherent with its research purpose but has implementation omissions and a few brittle assumptions that warrant manual review and sandboxed testing prior to use.