zotero-obsidian-bridge
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill workflow recommends executing a Python script (scripts/verify_paper_notes.py) provided within the skill package to validate the structure and consistency of generated Obsidian notes.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from Zotero (metadata, abstracts, fulltext, and annotations) to generate literature notes and synthesis documents. This processes untrusted external content that could potentially contain malicious instructions intended to influence the agent's behavior.
- Ingestion points: references/WORKFLOW.md identifies that the agent reads metadata, fulltext, annotations, and notes from Zotero via MCP tools.
- Boundary markers: The skill uses structured Markdown schemas and 'Evidence Records' defined in references/PAPER-NOTE-SCHEMA.md, but there are no specific delimiters or instructions to ignore embedded prompts in the Zotero-sourced text.
- Capability inventory: The skill utilizes Zotero-related MCP tools for data retrieval and executes a local Python script for note verification.
- Sanitization: The provided documentation and scripts do not describe any sanitization, filtering, or escaping of the research content fetched from Zotero.
Audit Metadata