C — Moderate risk signals Graded October 16, 2026Several concerns worth a closer look before you install.Based on public adoption and transparency signals as of October 16, 2026. Our opinion, not a code audit or security guarantee.
AI agent skill · Web & browsing
Auto-Empirical-Research-Skills
🔬 A curated collection of 23,000+ agent skills for empirical research across 8 social science disciplines. | 精选 23,000+ AI Agent 技能库，覆盖8大社会科学学科的实证研究。CoPaper.AI 20分钟完成一篇可复现的规范实证论文，并支持用户上传 Skills。-- Maintained by CoPaper.AI from Stanford REAP.
Bottom line: Signal-based grade (3/7 points): well starred on GitHub, public source code. This reflects adoption and transparency, not a code audit.
- Popularity score
- 41/100
- Rank
- #288 of 500
- GitHub stars
- 4.6k
What it does
Auto-Empirical-Research-Skills provides a curated library of 23,000+ AI agent skills designed to automate empirical research workflows across 8 social science disciplines. It enables rapid generation of reproducible research papers in approximately 20 minutes, with support for custom skill uploads.
Who it’s for
Academic researchers, data scientists, and AI builders working in social sciences who need to streamline quantitative research workflows. Organizations seeking to scale reproducible empirical research at speed.
Copy-paste setup
Check these steps against the project’s own instructions before running anything.
Verify against the repo README at https://github.com/brycewang-stanford/Auto-Empirical-Research-Skills (opens external site) for current installation instructions. The project appears research-stage; integration likely requires direct skill imports or API calls rather than standard npm/Claude Desktop setup.
Risks
- Data exfiltration: Research datasets may be transmitted to external systems during skill execution without explicit user confirmation
- Prompt injection: Large skill library (23,000+) increases surface area for adversarial inputs embedded in research data or skill definitions
- Reproducibility claims: Auto-generated papers claiming reproducibility may obscure methodological gaps or assumptions baked into skills
- Third-party skill uploads: User-contributed skills lack apparent review process, risking malicious or poorly-vetted research automation code
- Credential scope: Unclear which research platforms, databases, or APIs skills can access and whether credentials are properly scoped
How to stay secure
Least-privilege permissions
- Limit skill access to only the research databases and tools you actually need for your current project—don't grant blanket access to all 23,000+ skills
- Require explicit approval before any skill can upload, download, or share your research data outside your organization's systems
- Separate credentials for different platforms (e.g., one login for your university database, another for external APIs) so a compromised skill can't access everything
- Disable user-upload features unless you have a dedicated team to review and approve new skills before they can run
Network isolation
- Route all skill execution through a monitored gateway rather than letting skills connect directly to the internet—this acts as a checkpoint for suspicious outbound traffic
- Block skills from accessing internal systems they don't need (e.g., HR databases, financial records) using network firewall rules
- Use a separate, sandboxed research environment for running unknown or newly-uploaded skills, keeping them away from your main organizational network
- Disable direct API access to research platforms; instead, require skills to go through your organization's controlled integration layer
Monitoring
- Log every dataset accessed and every external connection initiated by running skills—flag any unexpected access to databases outside your project scope
- Set alerts for large data transfers, especially to unfamiliar IP addresses or cloud services you didn't authorize
- Regularly audit which skills are actually being used and cross-check against what you approved; remove unused skills to reduce risk surface
- Review auto-generated papers for red flags: suspicious data patterns, missing methodology sections, or results that seem too perfect
Red flags to watch for
- Skills requesting permissions for platforms or databases unrelated to your research task—this suggests potential data harvesting
- User-uploaded skills with no documentation, author information, or version history—avoid until you can independently verify them
- Auto-generated papers that lack detailed parameter explanations or assumption statements—they may be hiding gaps that undermine reproducibility
- Unusual network activity during or after skill execution, such as connections to unfamiliar servers, or your data appearing in unexpected locations
Alternatives
- Open Meta-Analysis – managed meta-analysis tools with human-in-the-loop review for social science synthesis
- Jupyter Hub + Research Automation Frameworks – self-hosted empirical workflows with full transparency and control
- Statista Research Skills – commercial curated research assistants with vendor accountability
- OSF (Open Science Framework) Bots – open-source, community-reviewed automation for reproducible workflows