pyzotero
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFEPROMPT_INJECTIONNO_CODE
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from the Zotero API which could be manipulated by an attacker to influence agent behavior.
- Ingestion points: Bibliographic metadata (e.g., titles, abstracts) and full-text PDF content are retrieved via methods such as
zot.items()andzot.fulltext_item(), documented inreferences/read-api.mdandreferences/full-text.md. - Boundary markers: The skill does not provide instructions for using delimiters to separate untrusted external data from the system prompt.
- Capability inventory: The skill is configured with
Bashtool access inSKILL.md, which increases the potential impact of a successful injection attack. - Sanitization: There is no evidence of content sanitization or validation for data retrieved from external sources.
Audit Metadata