zotero-cli

Pass

Audited by Gen Agent Trust Hub on Aug 25, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill relies on executing the zot and rak binary tools to interact with the local Zotero database and perform vector searches.
  • [EXTERNAL_DOWNLOADS]: The skill includes commands to add new items to the library from external URLs and DOI identifiers (e.g., arxiv.org, doi.org), which involves fetching metadata and potentially files from remote academic sources.
  • [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection by processing untrusted content from academic papers.
  • Ingestion points: External data is ingested through zot --json read, zot --json pdf, and rak --json search which extract metadata and full-text content from PDF documents in the user's library.
  • Boundary markers: The skill lacks explicit boundary markers or instructions for the agent to disregard instructions potentially embedded within the ingested paper data.
  • Capability inventory: The environment provides the ability to execute shell commands (zot, rak) and manage library collections.
  • Sanitization: No sanitization or filtering mechanisms are described to prevent the agent from acting on malicious instructions hidden in paper metadata or full-text content.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 25, 2026, 02:28 AM
Security Audit — agent-trust-hub — zotero-cli