Scholar Search

PassAudited by ClawScan on May 1, 2026.

Overview

Scholar Search appears purpose-aligned for academic lookup; the main things to notice are the required Semantic Scholar API key stored locally and a manual Python dependency install.

Install this skill if you are comfortable sending academic search queries to arXiv and Semantic Scholar, storing a Semantic Scholar API key in scripts/.env, and installing the requests Python package. Use a limited/revocable API key and avoid entering private or sensitive research queries if you do not want them sent to those services.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

Your Semantic Scholar API key may be saved on disk in the skill directory and used for requests to Semantic Scholar.

Why it was flagged

The skill requires a Semantic Scholar API key and instructs the agent to store a provided key locally for later API use.

Skill content

S2_API_KEY - Semantic Scholar API 密钥（必需...）；当我在对话中直接提供 Semantic Scholar API Key 时，必须先写入 ... scripts/set_s2_api_key.py

Recommendation

Use a revocable Semantic Scholar key, avoid sharing unrelated credentials, and remove or rotate the key if the skill directory is shared or backed up.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the dependency pulls code from the configured Python package source before the skill can run.

Why it was flagged

The skill relies on a manually installed, unpinned Python package. This is normal for a Python API wrapper but leaves dependency version and source resolution to the user environment.

Skill content

所需依赖：`requests`
  ```bash
  pip install requests
  ```

Recommendation

Install dependencies from a trusted package index or controlled environment, and pin versions if reproducibility matters.