zotero-add

SUSPICIOUS. The stated purpose fits the capabilities: creating Zotero items, collections, and attaching PDFs is coherent. The main concern is install/execution trust: the skill forwards a Zotero API key to an unverified local Python script in a personal repo path, with no supplied source review, packaging, or release provenance. Data flow appears intended for official Zotero endpoints, and there is no evidence of overt exfiltration or malware, but the credential-forwarding path is not independently verifiable from the provided material.