Is holic101/pubmed2blog safe?
Yes. holic101/pubmed2blog is safe to install. Oathe's behavioral security audit gave the pubmed2blog skill by holic101 a trust score of 84/100 with 5 findings, none critical or high.
https://github.com/openclaw/skills/tree/main/skills/holic101/pubmed2blog
Is holic101/pubmed2blog safe to install?
The pubmed2blog skill's SKILL.md is clean: it contains no prompt injection, no hidden instructions, no embedded URLs for autonomous fetching, and no obfuscation techniques. The primary risk is indirect — the npm install -g pubmed2blog install directive installs an unvetted global npm package whose preinstall/postinstall scripts were never executed in the sandbox, meaning any malicious install-time code would remain unobserved. Additionally, the pubmed2blog init API key setup flow and the unvetted Z.AI provider represent plausible credential harvesting and content exfiltration vectors if the npm package is compromised. Canary file integrity was confirmed clean throughout.
What security issues were found in holic101/pubmed2blog?
Category Scores
Findings (5)
MEDIUM Unvetted global npm package install -28 ▶
The skill's install directive runs npm install -g pubmed2blog, installing a third-party npm package globally under user privileges. The npm package was not executed during sandbox testing, so its preinstall/postinstall scripts were never observed. A malicious postinstall hook could perform arbitrary code execution, credential theft, or backdoor installation silently at install time.
MEDIUM API key collection via interactive init command -12 ▶
The pubmed2blog init command is described as 'Interactive setup for API keys and preferences' supporting Anthropic, OpenAI, and Z.AI providers. If the underlying npm package is malicious or compromised, running init would deliver live API credentials directly to attacker-controlled infrastructure. An agent following the skill's usage instructions would naturally run init as part of setup.
LOW Unvetted third-party AI provider (Z.AI) -8 ▶
The skill advertises Z.AI as a supported inference provider alongside Anthropic and OpenAI. Z.AI is not a widely recognized provider, and healthcare blog content generated through this provider would be transmitted to unknown infrastructure. Patient-facing articles could contain sensitive medical context.
LOW Cron scheduling creates persistence vector if npm package is malicious -10 ▶
The skill explicitly instructs agents to 'Schedule via cron for regular content generation.' While legitimate for the stated use case, if the installed pubmed2blog binary is malicious, an agent following this instruction would establish a persistent execution foothold that survives session termination.
INFO Credential file accesses observed but attributed to monitoring framework -5 ▶
auditd PATH records show .env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, and .config/gcloud/application_default_credentials.json were opened at two points during the audit. Both access clusters occur at identical millisecond timestamps (all six files at 1771934673.087 and again at 1771934696.052), consistent with the oathe monitoring system's pre-install baseline read and post-install comparison scan rather than the skill or npm package. Canary integrity confirmed clean.
Should I install holic101/pubmed2blog?
Oathe's verdict for holic101/pubmed2blog is SAFE with a trust score of 84/100. Recommendation: Install with caution.