The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted metadata (titles, abstracts) and PDF content from external academic sources.\n
Ingestion points: Bibliographic metadata is ingested from api.crossref.org and doi.org in scripts/doi_to_item.py. PDF text is extracted and reviewed by scripts/check_pdf.py.\n
Boundary markers: The instructions require the agent to run scripts/check_item.py and scripts/check_pdf.py to validate metadata and verify file integrity before committing changes to the Zotero library.\n
Capability inventory: The skill has the capability to perform network requests for metadata, download files via browser automation (using the opencli skill), and write to the local Zotero database.\n
Sanitization: scripts/check_item.py validates the item schema against the Zotero API, ensuring that unknown or invalid fields are either dropped or moved to a safe metadata container ('Extra').\n- [EXTERNAL_DOWNLOADS]: The skill retrieves research data from well-known academic services.\n
Evidence: The skill performs HTTP GET requests to api.crossref.org, doi.org, and papers.cool to fetch metadata and paper abstracts.\n- [CREDENTIALS_UNSAFE]: The skill manages an API key for the local Zotero instance.\n
Evidence: scripts/authorize_local_api.py implements an authorization flow and stores the resulting key at ~/.config/zotero/local-api-key. It correctly applies 0o600 file permissions to ensure only the user can read the key file.

paper-to-zotero