The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on executing Python code from a hardcoded local directory (/Users/niyaro/Documents/Code/zotero-code-execution). It explicitly instructs the agent to modify sys.path to include this specific directory and import local modules such as zotero_lib and setup_paths.
[PROMPT_INJECTION]: The skill processes untrusted external data from a Zotero library, including potentially large volumes of paper titles and abstracts.
Ingestion points: Research paper data enters the agent context via functions like orchestrator.comprehensive_search or library.search_items described in SKILL.md.
Boundary markers: The instructions do not specify any delimiters or warnings to treat the fetched Zotero data as untrusted content.
Capability inventory: The skill encourages the use of the code execution environment to process and filter this untrusted data.
Sanitization: There is no mention of sanitization or escaping techniques for the paper metadata before it is formatted and presented to the LLM.
[CREDENTIALS_UNSAFE]: The troubleshooting section in README.md references locations where sensitive user data and credentials are stored, specifically the ~/.config/zotero-mcp/config.json file and environment variables ZOTERO_API_KEY and ZOTERO_LIBRARY_ID.

zotero-mcp-code