Scientific Agent Skills is a collection of reusable procedures that give AI agents capabilities for scientific research across areas such as biology, chemistry, medicine, and drug discovery. It is used by researchers and by people building AI scientist workflows with compatible coding agents. The catalogue contains many of the project's skills and supporting instructions.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add K-Dense-AI/scientific-agent-skills --skill paperclipgit clone --depth 1 https://github.com/K-Dense-AI/scientific-agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/k-dense-ai/scientific-agent-skills/paperclip)<a href="https://agentmods.dev/skills/k-dense-ai/scientific-agent-skills/paperclip"><img src="https://agentmods.dev/badge/skills/k-dense-ai/scientific-agent-skills/paperclip/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/k-dense-ai/scientific-agent-skills/paperclip"><img src="https://agentmods.dev/badge/skills/k-dense-ai/scientific-agent-skills/paperclip.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Socket pass
- Snyk warn
- NVIDIA SkillSpector warn
SkillSpector: 9 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 6 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 34 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 50 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 68 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 71 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 107 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Rogue Agent · line 381 Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.Fix: Prevent the skill from modifying its own code, SKILL.md, or configuration files. Treat skill files as read-only at runtime.
- high Supply Chain · line 392 Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.Fix: Avoid downloading and executing remote scripts. Use trusted packages from PyPI/npm. If remote fetch is required, verify checksums and use HTTPS.
- medium Rogue Agent · line 4 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00171 | $0.05911 |
| Opus 5 | $0.00086 | $0.02955 |
| Sonnet 5 | $0.00034 | $0.01182 |
| Haiku 4.5 | $0.00017 | $0.00591 |
Grade C, and why
paperclip scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -fsSL https://paperclip.gxl.ai/install.sh | bash # macOS/Linux; ~/.local/bin/paperclip Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -fsSL https://paperclip.gxl.ai/install.sh | bash # macOS/Linux; ~/.local/bin/paperclip How it starts
The opening of the file, as written. The whole thing — 431 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Paperclip CLI
Paperclip exposes roughly 11M full-text papers, 217K+ regulatory documents, 110K+ clinical trial protocols, and 574K+ protein entries as a read-only virtual filesystem navigated with Unix commands, backed by server-side semantic search and LLM readers.
Every document is line-numbered, and that is the point of the tool: you cite #L45 and a reader
jumps to the exact sentence. Read the lines you cite, do not paraphrase past what they say, and never
present a semantic-search snippet as if you had read the paper.
Step 1 — preflight
Run this before anything else. It answers "is it installed" and "who am I" in one call.
command -v paperclip >/dev/null || echo "paperclip NOT INSTALLED"
command -v paperclip >/dev/null && { paperclip --version; [ -f .env ] && { set -a; . ./.env; set +a; }; paperclip config 2>&1 | grep -E "Auth|Health"; }
Read the Auth: line — it decides everything that follows:
| Output | Meaning | Do this |
|---|---|---|
✓ API key (env) |
The API key loaded. Correct state. | Proceed, using the auth prefix below |
✓ [email protected] |
The key did not load — this is stored OAuth, a different identity | If .env holds a key, you forgot the prefix. Fix it |
✗ (run: paperclip login) |
No credential at all | Ask the user to authenticate — see Installing |
paperclip NOT INSTALLED |
No binary | See Installing |
Health: ✓ server reachable is an unauthenticated probe, and Auth: ✓ only means a credential is
present, not valid. A junk key produces the same two lines. Prove the credential with a real query:
[ -f .env ] && { set -a; . ./.env; set +a; }; paperclip search -s pmc "test" -n 1
# invalid key → "[error] Authentication failed (API key invalid)." and exit 1
Step 2 — operating rules
These are the rules that make the difference between working and silently-wrong. They matter more than any individual command.
1. Put the auth prefix in every command
Shell state does not survive between tool calls. Exporting the key in one call and running
paperclip in the next means the key is gone — and Paperclip does not error, it silently falls
back to stored OAuth, i.e. a different identity and possibly a different account.
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 431 lines · 171 tokens per session scan C ea7d7ad27f0d
paperclip is a skill published in the GitHub repository K-Dense-AI/scientific-agent-skills (44,220 stars, last pushed 4d ago), licensed MIT. It adds 171 tokens to every session and 5,911 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
discovery-toolbox
A routed repertoire of 90 scientific thinking operators for biological research agents - visual reasoning, detectability and information budgets, search reframing, causal identification, competing explanations, observation and selection processes, pipeline artifact diagnosis, effort allocation, and confirmation…
discovery-director
Operate as a research director making original discoveries from a given biological question and dataset. Use when the task is open-ended scientific research, exploring omics or experimental data for findings, hypothesis generation and testing, screening a large candidate space of genes, variants, features or…
polars-dovmed
Search PMC Open Access and bioRxiv corpora with polars-dovmed. Use when structured, reproducible literature queries should run through the hosted API or local parquet indexes.
bio-interdomain-hgt
Detect and polarize interdomain horizontal gene transfer with homology, context, and phylogenetic checks. Use when studying lateral gene transfer, virus-host gene exchange, endogenous viral elements, or donor direction.
csag-extraction
Extract a Conditional Scientific Argumentation Graph and grounded Q&A from a manuscript. Use when representing assertions, contexts, evidence links, and inference steps in machine-readable form.
exploratory-data-analysis
Inspect scientific data and generate a Markdown structure-and-quality report. Use when triaging tabular, array, sequence, HDF5, JSON, or raster files before downstream analysis.