pyzotero
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection because it ingests untrusted data from the Zotero API and processes it within the agent's context.
- Ingestion points: External data is ingested via bibliographic item retrieval (
zot.items()), note content (zot.children()), and full-text content extracted from PDF attachments (zot.fulltext_item()). - Boundary markers: The skill does not implement boundary markers or instructions to ignore embedded commands in the retrieved bibliographic data or note contents.
- Capability inventory: The skill has the capability to write files (exporting to .bib, .ris, and downloading attachments), perform network operations (communicating with the Zotero Web API), and execute shell commands (via the
pyzoteroCLI). - Sanitization: There is no evidence of sanitization or validation of the retrieved content (e.g., full-text content from PDFs) before it is passed to the agent.
- [COMMAND_EXECUTION]: The skill documentation includes examples of using the
Bashtool to run thepyzoterocommand-line interface for tasks such as searching the local Zotero library and retrieving DOI indexes.
Audit Metadata