Monitor and discuss research papers from one Paperzilla project using the `pz` CLI inside OpenClaw. Use when users want recent papers, metadata, markdown-bas...
Security Analysis
high confidenceThe skill's requests and runtime instructions are consistent with its stated purpose of driving the Paperzilla CLI to monitor a project; it asks for no credentials and has no install actions.
Name/description match the required artifacts: the skill requires the 'pz' CLI and explicitly uses it for project/ feed/ paper operations. No unrelated binaries, credentials, or unexpected system access are requested.
SKILL.md is narrowly scoped to running pz CLI commands (exec) and delivering output via message only when profile-approved or user-requested. It explicitly forbids reading arbitrary files or unrelated environment variables. It does direct the agent to persist a per-project history of proposed Paperzilla IDs across runs (profile-owned state), which is within scope for a recurring brief workflow.
Instruction-only skill with no install spec and no code files. This is low risk and consistent with relying on a preinstalled 'pz' binary.
The skill requires no environment variables or credentials and assumes the human has already run 'pz login'. There are no requests for unrelated secrets or external service credentials.
always:false and normal autonomous invocation. The skill asks to store a per-project history of Paperzilla IDs in scheduling job state or profile-owned memory to avoid repeat suggestions; this is reasonable for recurring briefs but you should confirm where that storage lives and retention/purging rules.
Guidance
This skill appears coherent and limited: it will run your local 'pz' CLI (so it will act with whatever Paperzilla identity you already logged in with) and may persist a list of previously suggested paper IDs in the agent/profile memory to avoid repeats. Before enabling: (1) confirm the 'pz' binary on the host is the official CLI and that you’ve authenticated it intentionally; (2) ask where the per-project history will be stored and how long it is retained if you care about privacy; (3) confirm the host's OpenClaw message routing (Telegram) is trusted before allowing scheduled external deliveries. No credentials or installs are requested by the skill itself.
Latest Release
v1.1.4
Split OpenClaw profile into SKILL.md + AGENT.md, keep explicit rec vs paper handling, feedback commands, and safer delivery rules.
More by @pors
Published by @pors on ClawHub
