The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The scripts/install_cli.py script facilitates the download of a platform-specific CLI binary (zotero-go-cli) from the author's GitHub repository (drguptavivek/zotero-go-cli). The process incorporates integrity checks via SHA-256 checksums and signature verification on macOS.
[COMMAND_EXECUTION]: The skill performs shell command execution for environment diagnostics, such as identifying the presence and version of local tools like zot, uv, and git. It also utilizes the codesign utility on macOS for binary verification.
[DYNAMIC_EXECUTION]: The scripts/selftest.py script employs Python's compile() function to validate the syntax of internal scripts. It also uses dynamic imports for a predefined list of standard library modules to confirm the execution environment's readiness.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external DOCX files and Zotero metadata, creating a surface for potential indirect prompt injection attacks. This is addressed by a non-modifying validator script and instructional safeguards requiring human review and manual citation refreshing.
[DATA_EXFILTRATION]: The skill manages sensitive Zotero API credentials. scripts/selftest.py includes a sanitization routine that masks API keys and library IDs in diagnostic output, preventing their accidental exposure in logs or user-facing responses.

zotero-use