Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Arxiv Batch Reporter
v0.1.1Generates a batch arXiv report by combining model-written templates with brief conclusions and abs URLs extracted from per-paper summary.md files.
⭐ 0· 750·2 current·2 all-time
by@xukp20
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description promise (assemble a batch arXiv report from per-paper summary.md files) matches the included artifacts. The two scripts only read metadata.json/metadata.md and summary.md under a provided base directory and produce bundle/template/rendered markdown files. No unexpected binaries, env vars, or external services are required.
Instruction Scope
SKILL.md instructs: run collect_summaries_bundle.py to produce a bundle, have the model author a template with placeholders, then run render_collection_report.py to replace placeholders with brief conclusion text and an arXiv URL. The scripts implement exactly those behaviors and do not instruct the agent to read unrelated system files or to transmit data externally.
Install Mechanism
There is no install spec (instruction-only plus accompanying scripts). No network downloads, package installs, or archive extraction are present in the manifest, minimizing install-time risk.
Credentials
The skill declares no required environment variables, no primary credential, and no config paths. The scripts do not read environment variables or request credentials; they operate only on files under the user-supplied base directory.
Persistence & Privilege
always is false and the skill does not modify other skills or global agent settings. The scripts write output files under the provided base directory only and print a JSON summary to stdout; they do not persist state across runs outside the run-directory outputs.
Assessment
This skill is internally consistent with its stated purpose, but take these practical precautions before running it: 1) Run the scripts only on trusted run directories — the scripts will read all summary.md/metadata files under base-dir and write output files there. 2) Review any model-authored template (collection_report_template.md) before rendering — the template can be an absolute path and will be read; ensure it doesn't contain unexpected content. 3) The scripts print a JSON payload that includes full paths (base_dir, template_path, output_path); if your stdout is captured or forwarded, that could reveal local paths. 4) If you run as a high-privilege user on an attacker-controlled base-dir, a maliciously prepared run-dir could cause the scripts to read/write files you may not expect — run as an ordinary user and/or validate the run-dir contents first. 5) The scripts do not perform any network calls or credential use, but they do embed raw summary text into outputs; if summary.md content includes control characters or secrets, those will be propagated into collection_report.md.Like a lobster shell, security has layers — review code before you run it.
latestvk97dtbex3nz2jt27tvr825j1xd814bb9
License
MIT-0
Free to use, modify, and redistribute. No attribution required.