paper-to-zotero

The code is primarily a DOI/arXiv-to-Zotero metadata conversion and file-writing utility. No clear malware, backdoor, credential theft, shell execution, or covert exfiltration is present. A concrete security risk exists because explicit record slugs are not sanitized before being joined with the output directory; attacker-controlled input can cause path traversal or unintended file overwrite. DOI_BASE_URL and --base-url also permit routing requests to arbitrary endpoints, which should be restricted in deployments handling sensitive identifiers. The provided fragment additionally contains an incomplete `EPILOG =` assignment that causes a syntax error.