The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/get_zotero_pdf.py contains a path traversal vulnerability. The attachment_key argument provided to the script and the filename metadata retrieved from the Zotero API are used to construct file paths without sanitization or validation.
Evidence in find_local_pdf: storage_folder = zotero_storage / attachment_key. If the key contains traversal characters (e.g., ../../), it could access directories outside the Zotero storage folder.
Evidence in download_pdf: output_path = f"/tmp/{original_filename}". If the filename retrieved from the API contains traversal sequences, the curl -o command could overwrite sensitive files the user has permission to write to.
[EXTERNAL_DOWNLOADS]: The skill fetches PDF attachments from Zotero's official API (api.zotero.org). While this is a well-known service, the files downloaded are external and untrusted content.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an ingestion surface for untrusted data from external academic papers.
Ingestion points: PDF files downloaded via scripts/get_zotero_pdf.py and subsequently read as Markdown.
Boundary markers: None present in the instructions to the agent; the agent is instructed to read the abstract and sections strategically.
Capability inventory: The skill can execute shell commands via curl, read local files, and run Python scripts.
Sanitization: No sanitization or filtering of the PDF/Markdown content is performed before the agent reads it.
[COMMAND_EXECUTION]: The skill uses subprocess.run to execute curl commands. While it correctly uses a list format to prevent shell injection, the lack of argument sanitization for the output path remains a risk.

zotero-paper-reader