Skills/ClawHub/pubmed-verifier

pubmed-verifier@6.3.0

VERIFIED

Publisher claims: "Reference checker for AI-fabricated citations: batch-verify PMIDs against PubMed and catch the hallucination existence checks miss — a REAL PMID pointing to a DIFFERENT paper. Five-state citation verification (correct / mismatch / partial / invalid / unknown), citation-context parsing, Crossref DOI cross-check, retraction detection (capped at partial), correct-PMID suggestion, arXiv ID verification, plain-text reference list parsing, formatted reference lists (GB/T 7714 / Vancouver / APA / AMA), OpenAlex DOI fallback for non-Crossref registries, Chinese-reference title search, CSV/JSON claims, HTML/JSON/text reports. Four data sources: NCBI, Europe PMC fallback, Crossref, OpenAlex. Network failures are honestly reported as unverified, never as "not found". Zero dependencies, runs fully local. Triggers: verify PMIDs, check citations, citation audit, reference check, citation check, batch verify references, AI hallucination detection, verify DOI, DOI check, citation formatting, reference formatter, GB/T 7714." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher docsor1212 · joined 12 days agoInstalls 2,908Last detonated 3d ago
$clawhub install pubmed-verifier
WatchReport an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-31 and scored it 83/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

MEDIUM
File type combined with upload actionSKILL.md:178 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
URL with embedded credentialsscripts/verify_pmids.py:4697 · URL with embedded credentials — may be phishing or credential leakingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
HIGH
URL with embedded credentialsscripts/verify_pmids.py:4696 · URL with embedded credentials — may be phishing or credential leakingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
File type combined with upload actionscripts/verify_pmids.py:55 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07