p-pdf2zotero

SUSPICIOUS. The skill's core purpose and capabilities mostly align: local PDF import into Zotero, deduplication, collection placement, and metadata cleanup. The main concern is not malware or credential theft but integrity risk: it bypasses Zotero's preferred APIs and directly edits the SQLite database via an undocumented local helper workflow. No external exfiltration, credential harvesting, or malicious install chain is evident, but the undocumented helper and raw DB mutation make this higher-risk than a normal documentation or API-only skill.