zotero-cli
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on executing the
zotandrakbinary tools to interact with the local Zotero database and perform vector searches. - [EXTERNAL_DOWNLOADS]: The skill includes commands to add new items to the library from external URLs and DOI identifiers (e.g., arxiv.org, doi.org), which involves fetching metadata and potentially files from remote academic sources.
- [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection by processing untrusted content from academic papers.
- Ingestion points: External data is ingested through
zot --json read,zot --json pdf, andrak --json searchwhich extract metadata and full-text content from PDF documents in the user's library. - Boundary markers: The skill lacks explicit boundary markers or instructions for the agent to disregard instructions potentially embedded within the ingested paper data.
- Capability inventory: The environment provides the ability to execute shell commands (
zot,rak) and manage library collections. - Sanitization: No sanitization or filtering mechanisms are described to prevent the agent from acting on malicious instructions hidden in paper metadata or full-text content.
Audit Metadata