pp-zotero-research-library

SUSPICIOUS. The core Zotero-search purpose and official-looking same-publisher install paths are coherent, so this is not fundamentally incompatible or overtly malicious. However, the skill's footprint is broader than a simple read-only library searcher: it requires a separate CLI, stores credentials locally, performs automatic background learning writes, can register an MCP server, and can exfiltrate command output to arbitrary webhook URLs if used. That makes it a medium-risk agent integration rather than a clearly benign documentation-only skill.