The Agent Skills Directory

[SAFE]: No malicious patterns, obfuscation, or persistence mechanisms were detected. The skill's functionality is entirely consistent with its described purpose of interacting with the Zotero reference management system.
[EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the 'pyzotero' library, which is a well-known and trusted Python wrapper for the Zotero API. This is a standard and expected dependency for the skill's functionality.
[PROMPT_INJECTION]: The skill has an inherent surface for indirect prompt injection as it retrieves bibliographic metadata and full-text content from the Zotero Web API, which could contain adversarial content if an attacker controls library items.
Ingestion points: Data enters the agent's context through bibliographic retrieval methods (e.g., zot.items()) and full-text retrieval (zot.fulltext_item()) as documented in references/read-api.md and references/full-text.md.
Boundary markers: The instructions do not specify delimiters or provide explicit warnings for the agent to treat the retrieved text as untrusted data.
Capability inventory: The skill is granted Bash and Write tool permissions in SKILL.md. It also includes functionality for writing attachment files to the local file system using zot.dump() as described in references/files-attachments.md.
Sanitization: There is no explicit sanitization or filtering of the retrieved bibliographic text before it is processed by the agent.
Note: This attack surface is inherent to any tool that processes research data and represents a standard operational risk rather than a malicious design. The finding is assessed as safe within the context of the skill's primary purpose.

pyzotero