zotero-report

SUSPICIOUS: The skill's purpose and capabilities mostly align, and its credentials/permissions are proportionate for Zotero research automation. The main risk is trust: it delegates work and API-key use to local scripts from a lightly verified personal project with weak release provenance, so the overall concern is supply-chain and opaque helper-script behavior rather than clear malicious intent.