zotero-search
Warn
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the 'pyzotero' package and its command-line interface ('pyzotero[cli]') from PyPI. This package is authored by a third party not present on the trusted vendors list.
- [COMMAND_EXECUTION]: The agent is instructed to run shell commands using 'pyzotero' and 'jq'. This includes search operations, metadata extraction, and complex filtering of JSON search results.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local Zotero databases and the external Semantic Scholar API, which could contain malicious instructions.
- Ingestion points: Metadata fields (titles, abstracts), and full-text PDF contents when using the --fulltext flag in the SKILL.md and output-guidelines.md files.
- Boundary markers: No explicit delimiters are used to wrap or sanitize the ingested research data to prevent the agent from following embedded instructions.
- Capability inventory: The agent has the capability to execute shell commands and read file system paths provided in the results.
- Sanitization: There is no evidence of sanitization for strings retrieved from external bibliographic sources or local PDF contents.
- [DATA_EXFILTRATION]: The skill facilitates the exposure of local filesystem structure by revealing the paths to PDF attachments (e.g., 'file:///path/to/paper.pdf') to the agent. Additionally, research interests and identifiers are shared with the external Semantic Scholar service during search and citation analysis operations.
Audit Metadata