cnki-export

This module is primarily a legitimate Zotero ingestion/attachment uploader, but it carries a meaningful misuse risk when processing untrusted JSON. The code can (1) download PDFs from attacker-controlled URLs without validation and (2) forward an input-provided 'cookies' string as an HTTP Cookie header to those destinations, enabling credential/session-token forwarding and SSRF-like behavior from the machine running the script. No clear evidence of intentional malware/backdoor behavior is present in this fragment (no exec/subprocess/persistence), but security review and input validation/allowlisting for pdfUrl and strict handling of cookies are strongly recommended.