by 安全扫描
OpenClaw
安全
medium confidenceNULL
评估建议
This skill appears internally consistent: it downloads arXiv source/pdf artifacts and asks the model to manually read those artifacts and write summary.md files. Before installing/using it, do the following checks: 1) Open the full scripts (the prompt contained truncated files) and confirm that all network requests are aimed at legitimate arXiv endpoints (e.g., arxiv.org) and not to unknown third-party URLs. 2) Run the scripts in an isolated workspace (or container) so downloads and extracted fi...详细分析 ▾
✓ 用途与能力
Name/description match the included artifacts: three downloader scripts and a batch orchestrator. The files and SKILL.md describe downloading arXiv source/PDF, local throttling, extraction, and asking the model to manually produce summary.md. There are no unrelated environment variables, binaries, or config paths requested.
✓ 指令范围
SKILL.md instructs the agent to only use the scripts for artifact download and to perform model-driven reading and manual summary writing. The instructions reference only per-paper directories, metadata files, extracted source, and PDFs. They explicitly forbid using scripts or regex-based extraction to auto-generate summaries. Note: parts of the code in the prompt were truncated, so I could not fully confirm every URL construction; verify that network requests target arXiv endpoints only.
✓ 安装机制
There is no install spec (instruction-only skill with bundled scripts). This is lowest-risk from an install perspective: the skill will not download remote install artifacts on install time. The included Python scripts are run by the user/agent at runtime.
✓ 凭证需求
The skill declares no required environment variables, credentials, or config paths. The scripts perform HTTP requests and write local files under per-paper directories; this is proportionate to the stated purpose.
✓ 持久化与权限
Flags show always: false and normal autonomous invocation allowed. The skill does not request permanent system-wide presence or modify other skills. Its runtime behavior is limited to writing artifacts and logs in the provided run/paper directories.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.1.12026/2/14
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install arxiv-paper-processor
镜像加速npx clawhub@latest install arxiv-paper-processor --registry https://cn.longxiaskill.com