literature-review-tools

执行命令读凭据写文件联网严重 12 · 高危 7brycewang-stanford/Auto-Empirical-Research-Skills

它会碰到什么

扫了多少6 个文本文件，59 KB

它会碰到什么执行命令读凭据写文件联网

命中总数22 处

命中统计严重 12 · 高 7 · 中 1 · 低 2

逐条看命中（19 条严重或高危）

严重 recipes/recipes.json:6perm-wildcard

tools: [
    {
      "id": "mineru",
      "name": "MinerU",
      "category": "pdf-extraction",
      "kind": "python-cli",
      "repo": "https://github.com/o

严重 recipes/recipes.json:90cred-paths

"notes": "FastAPI + web frontend. Reads keys from a .env in the repo root (litrun writes it for you). Serves at :8000."

严重 scripts/litrun.py:6cred-paths

collide. API keys live in one shared ~/.lit-review-tools/.env.

严重 scripts/litrun.py:12cred-paths

litrun.py env [--set KEY=VALUE ...]     # show / edit the shared .env

严重 scripts/litrun.py:39cred-paths
```
ENV_FILE = BASE / ".env"
```

严重 scripts/litrun.py:97cred-paths

"""OS environ overlaid with the shared .env (OS wins if already set)."""

严重 scripts/litrun.py:240cred-paths

print("\n== API keys seen (OS env + .env) ==")

严重 scripts/litrun.py:443cred-paths

(clone_dir / ".env").write_text("".join(lines))

严重 scripts/litrun.py:444cred-paths

print(f"Wrote {len(lines)} key(s) to {clone_dir / '.env'}", file=sys.stderr)

严重 scripts/litrun.py:504cred-paths

p_env = sub.add_parser("env", help="show/edit the shared .env")

严重 SKILL.md:37cred-paths

`~/.lit-review-tools/.env`. Machine-readable recipes: [`recipes/recipes.json`](recipes/recipes.json).

严重 SKILL.md:55cred-paths

For **`gpt-researcher`** and **`storm`**, `litrun.py ui <id>` clones the repo and launches the full web UI (GPT Researcher → FastAPI at :8000; STORM → Streamlit

高 scripts/litrun.py:36cred-envread

BASE = Path(os.environ.get("LITRUN_HOME", Path.home() / ".lit-review-tools"))

高 scripts/litrun.py:142exec-spawn

return subprocess.run(cmd, env=env, check=check, cwd=cwd)

高 scripts/litrun.py:448cred-envread

env["PATH"] = f"{binpath}{os.pathsep}{env.get('PATH', '')}"

高 scripts/litrun.py:482identity-config-write

print("#   Claude Code: ~/.claude.json  (or project .mcp.json)   |   Claude Desktop: claude_desktop_config.json")

高 scripts/litrun.py:482identity-config-write

print("#   Claude Code: ~/.claude.json  (or project .mcp.json)   |   Claude Desktop: claude_desktop_config.json")

高 scripts/litrun.py:484identity-config-write

print("#   Cursor: ~/.cursor/mcp.json  (or .cursor/mcp.json in the project)")

高 scripts/litrun.py:484identity-config-write

print("#   Cursor: ~/.cursor/mcp.json  (or .cursor/mcp.json in the project)")

这一栏是扫描器报的事实，不是结论。命中多不等于有毒（安全工具、规则库、示例脚本本来就会包含危险写法），命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系，需要你自己看。

技能内容

Literature Review Tools — Select & Run

A curated, use-case-organized catalog of the strongest open-source AI tools for

literature review — plus a launcher that actually installs and runs the top ones.

Covers: end-to-end research agents, deep-research / auto-survey generators, autonomous

"idea→paper" systems, citation-backed RAG over PDFs, PRISMA screening, MCP servers,

Zotero/Obsidian integrations, PDF→structured extraction, citation graphs, and

paper-writing / peer-review assistants.

Full source of truth (README, always current star counts): <https://github.com/brycewang-stanford/lit-review-agent-tools>

Two modes

Recommend — user asks "what should I use to …". Route with the tables below; cite the catalog for details.
Run — user asks to install / run / use a specific tool ("turn this PDF into Markdown with MinerU", "ask PaperQA2 about these papers", "set up the arXiv MCP server"). Drive [scripts/litrun.py](scripts/litrun.py) via Bash — do not hand the user raw pip commands to copy.

Run mode — how to drive `scripts/litrun.py`

The launcher installs each supported tool into its own venv under ~/.lit-review-tools/

(uses uv if present, else python -m venv) and reads API keys from one shared

~/.lit-review-tools/.env. Machine-readable recipes: [recipes/recipes.json](recipes/recipes.json).

Typical flow when the user wants to use a tool:

python3 scripts/litrun.py doctor — check toolchain + which API keys are already set.
python3 scripts/litrun.py info <id> — confirm what the tool needs (entry, required env).
If a required key is missing, ask the user for it, then litrun.py env --set KEY=VALUE (never echo the value back in full).
python3 scripts/litrun.py run <id> -- <tool args> — installs on first use, then runs. For PDF tools pass the real file path; e.g. run mineru -- -p paper.pdf -o ./out -b pipeline.
For MCP servers, don't "run" them — litrun.py mcp <id> prints the client config block to register in Claude Code / Cursor.

Commands: list [--category C] [--kind K] · info <id> · doctor · env [--set K=V] · install <id> · run <id> -- <args> · mcp <id> [--storage PATH] [--client claude|cursor] · ui <id>.

Runnable ids by kind:

python-cli (auto install+run): mineru, marker, docling (PDF→Markdown) · paper-qa (cited Q&A) · asreview (PRISMA screening UI)
python-script (bundled, auto install+run): arxiv-fetch (search arXiv & download PDFs, no key)
python-lib (install + run example): gpt-researcher, storm (deep research; need API keys) · scholarly, pyalex (API clients)
mcp-server (install + mcp config): arxiv-mcp-server, paper-search-mcp, zotero-mcp

For gpt-researcher and storm, litrun.py ui <id> clones the repo and launches the full web UI (GPT Researcher → FastAPI at :8000; STORM → Streamlit at :8501). These are long-running servers — launch them with a background Bash call and tell the user the URL. gpt-researcher's UI needs OPENAI_API_KEY + TAVILY_API_KEY set first (litrun writes them into the repo's .env); STORM takes its keys in the app sidebar.

Chained pipelines

For multi-tool tasks, prefer a named workflow over hand-wiring steps: litrun.py workflow list then litrun.py workflow run <id> [--input PATH] [--query "..."] [--question "..."] [--max N]. Built-ins:

pdf-to-markdown — a PDF/folder → clean Markdown (MinerU)
pdf-corpus-qa — a folder of PDFs → citation-backed answer (PaperQA2)
pdf-md-then-qa — convert to Markdown and answer a question over the corpus
topic-to-pdfs — arXiv query → download top-N PDFs (arxiv-fetch, no key)
topic-to-review — arXiv query → download PDFs → citation-backed answer (PaperQA2). The end-to-end "retrieve then review" pipeline; no MCP client needed. Needs OPENAI_API_KEY for the QA step.

Add --dry-run first to show the exact resolved step commands without executing — good for confirming paths with the user before a heavy run. Workflows fail fast if a required API key is missing.

Guardrails: installs and downloads happen under the user's home and hit the network — for a heavy first install (marker/docling pull in PyTorch) say so before running. Never fabricate API keys. If a run fails, show the real error rather than claiming success. Paths in this file (scripts/…, recipes/…) are relative to this skill's directory.

Recommend mode — how to route

Identify which stage of the lit-review workflow the user is on (search → read → extract → synthesize → screen → cite-check → write/review).
Match it to a category below and recommend the ⭐ editor's pick first, then 1–2 alternatives.
For anything beyond the top pick — full star counts, every project in a category, or a category not summarized here — read [reference/catalog.md](reference/catalog.md). Do not guess project names or URLs; pull them from the catalog.
Give a one-line "why this one" tied to the user's constraint (Claude Code vs. standalone, open vs. commercial, privacy/local, medical, etc.). If the pick is a runnable id above, offer to install/run it.

⚡ 30-second picker

Use Claude Code, want end-to-end research→paper ──────────▶ academic-research-skills ⭐
Want AI to research a topic → cited report ───────────────▶ GPT Researcher / STORM
Want fully autonomous "idea → submittable paper" ────────▶ AI-Scientist-v2 / AutoResearchClaw
Citation-backed Q&A over a pile of PDFs ──────────────────▶ PaperQA2
Rigorous PRISMA review (thousands of abstracts) ─────────▶ ASReview / prismAId
Clean Markdown from PDFs to feed an LLM ─────────────────▶ MinerU / Docling / marker
Lit capabilities inside Claude / Cursor (MCP) ───────────▶ paper-search-mcp / zotero-mcp
Chat with your library inside Zotero ────────────────────▶ zotero-gpt / PapersGPT
Pre-submission AI peer review ───────────────────────────▶ open_reviewer / ai-peer-review

Categories (top pick per category)

| Category | Editor's pick ⭐ | When |

|---|---|---|

| All-in-one research agents & skills | academic-research-skills | Claude Code user wanting research→write→review→revise, with integrity/citation gates |

| Deep research & auto-survey | STORM / gpt-researcher | Topic → cited survey / report / related-work |

| Autonomous science (idea→paper) | AI-Scientist(-v2) / AutoResearchClaw | Fully automated discovery: lit + hypotheses + experiments + writing |

| Literature Q&A / RAG | paper-qa (PaperQA2) | Citation-backed answers over a PDF corpus |

| Systematic review & screening | ASReview | Active-learning screening of thousands of abstracts (PRISMA) |

| MCP servers | zotero-mcp / arxiv-mcp-server | Wire papers into Claude / Cursor / Cline |

| Zotero / Obsidian integration | zotero-gpt | Chat with your library inside your reference manager |

| PDF → structured extraction | MinerU / docling / marker | Turn PDFs into clean Markdown/JSON for LLMs |

| Citation graphs & API clients | scholarly / pyalex | Citation-network analysis; scripting academic DBs |

| Writing & peer-review assistants | open_reviewer / ai-peer-review | Draft, polish, and pre-submission review |

| Awesome lists | Awesome-Auto-Research-Tools | Browse the whole landscape |

Decision table (map need → recommendation)

| User's need | Recommend |

|---|---|

| Claude Code, end-to-end research→paper | academic-research-skills (most complete, #1 in space) |

| Generic "research this topic for me" agent | GPT Researcher / STORM |

| Wiki/survey-style long-form with citations | STORM / Co-STORM |

| Fully autonomous "idea → submittable paper" | AI-Scientist-v2 / AutoResearchClaw |

| Cited Q&A over many PDFs | PaperQA / PaperQA2 |

| Rigorous PRISMA systematic review | ASReview or prismAId |

| PDF → clean Markdown for an LLM | MinerU / Docling / marker |

| Lit capabilities in an MCP client | paper-search-mcp / zotero-mcp |

| Chat with library inside Zotero | zotero-gpt / PapersGPT |

| AI pre-review before submission | open_reviewer / ai-peer-review |

| Just want to browse the landscape | The Awesome lists section |

Notes & caveats

Open-source is prioritized. Commercial/closed tools (Elicit, Consensus, Scite, SciSpace, Research Rabbit, Connected Papers) are listed for reference only — see the catalog's commercial section.
Star counts drift. The catalog's numbers are periodic GitHub-API snapshots — treat as rough popularity signals, not exact. For live numbers, point the user at the repo.
Match the constraint, not just the task. Privacy/local → local-deep-research; medical → medsci-skills / paperai; Codex instead of Claude → academic-research-skills-codex.

Full catalog with every project, star count, and one-line description: [reference/catalog.md](reference/catalog.md).

想直接用这个技能？

本站把开放许可（MIT / Apache 等）的技能按仓库打包整理到网盘，点一下转存到你自己的网盘，不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接，不打包。

去原始仓库

它属于哪个仓库

仓库brycewang-stanford/Auto-Empirical-Research-Skills

星标★ 3,829

本站分层T1

该仓技能数1161

原文件路径skills/71-brycewang-lit-review-agent-tools/literature-review-tools/SKILL.md

同一个仓库里的其他技能

看这个仓库的全部 1161 个技能