zotero-obsidian-bridge
Pass
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes external data (Zotero metadata, annotations, and full text) which introduces an indirect prompt injection attack surface.
- Ingestion points: Zotero item retrieval (via MCP or local fallback) as described in
references/WORKFLOW.mdandSKILL.md. - Boundary markers: Absent. There are no explicit delimiters or specific instructions for the agent to treat the external Zotero content as potentially untrusted data.
- Capability inventory: The skill allows file system writes (creating and updating notes in the Obsidian vault) and script execution (
verify_paper_notes.py). - Sanitization: No sanitization or safety-specific filtering of the ingested external text is mentioned in the instructions.
- [COMMAND_EXECUTION]: The skill includes and utilizes a local Python script for validating paper note schemas and collection coverage.
- Evidence: The
scripts/verify_paper_notes.pyfile is provided within the skill and is intended to be executed as specified inreferences/WORKFLOW.md. - Analysis: The script uses only standard Python libraries (argparse, re, sys, pathlib) to perform local validation of markdown files and does not perform network operations or other high-risk actions.
Audit Metadata