research-zotero
Pass
Audited by Gen Agent Trust Hub on Jul 17, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill creates an attack surface for indirect prompt injection by processing external metadata from Zotero libraries.
- Ingestion points: Metadata such as item titles, abstracts, and notes are fetched via
scripts/fetch_zotero_items.pyfrom external libraries. - Boundary markers: Data is stored in JSON and Markdown formats without explicit boundary markers or instructions for downstream agents to ignore embedded commands.
- Capability inventory: The skill performs file system writes across its script suite to store research artifacts.
- Sanitization: There is no validation or sanitization of the content retrieved from the Zotero API before it is stored or presented to the agent.
- [SAFE]: API credential handling is implemented using environment variables (
$ZOTERO_API_KEY), avoiding hardcoded secrets. Network communication is limited to the official Zotero domain (api.zotero.org) for the skill's intended research purpose.
Audit Metadata