pyzotero
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data retrieved from Zotero libraries, including bibliographic metadata, notes, and full-text PDF content. This creates an attack surface where malicious instructions embedded in research papers or library items could influence agent behavior.
- Ingestion points: Untrusted content enters the agent's context through methods like
zot.items(),zot.fulltext_item(), and thepyzotero searchcommand-line utility (referenced inreferences/read-api.mdandreferences/cli.md). - Boundary markers: The instructions do not mandate the use of delimiters or specific warnings to ignore instructions found within retrieved bibliographic data.
- Capability inventory: The agent has access to powerful tools including
Bash,Write, andEdit, which could be exploited if the agent follows instructions hidden within ingested library data. - Sanitization: There are no requirements to sanitize, escape, or validate the content of retrieved Zotero items before processing them.
Audit Metadata