Research Paper Push
PassAudited by VirusTotal on May 10, 2026.
Overview
Type: OpenClaw Skill Name: research-paper-push Version: 1.0.1 The skill is a legitimate tool for managing research paper subscriptions via the OpenAlex API and scheduling daily summaries using the OpenClaw cron system. The code in `scripts/manage_papers.py` handles subscription logic, local JSON storage in a `data/` directory, and utilizes `subprocess` to interact with the platform's cron utility as intended. While it includes a fallback to `curl` for network requests to handle potential SSL issues in specific environments, the URLs are properly constructed and point only to the official OpenAlex API (api.openalex.org). No indicators of data exfiltration, malicious prompt injection, or unauthorized persistence were found.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent may create a recurring task that keeps running and sending paper summaries until removed.
The skill deliberately creates persistent scheduled jobs. This matches the paper-alert purpose, but scheduled activity can continue after the initial user interaction.
`add` — create a subscription and register a cron job.
Only create subscriptions after confirming recipient, time, timezone, journals, and topics; periodically list and remove cron jobs/subscriptions that are no longer needed.
Local generated files may reveal a user's research interests or message recipient identifiers if shared or published.
The script stores persistent local subscription state, which can include recipient IDs, topics, journals, schedule, and last-checked dates.
DATA_DIR = Path("data")
SUBSCRIPTIONS_FILE = DATA_DIR / "subscriptions.json"Keep generated data files private, do not publish `data/*.json`, and remove subscriptions/data when they are no longer needed.
Research topics, journal preferences, and optional contact email may be sent to OpenAlex during tests or scheduled runs.
The script sends user-configured research topics and date filters to the OpenAlex API, which is central to the skill's purpose and disclosed in SKILL.md.
with urllib.request.urlopen(req, timeout=25) as resp:
return json.loads(resp.read().decode("utf-8"))Use the skill only for topics you are comfortable querying through OpenAlex, and avoid placing secrets or private channel credentials in command options or generated files.