cli-anything-zotero
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from Zotero library items, notes, and metadata, which is subsequently used to construct context for the AI agent.
- Ingestion points: Data is retrieved from the Zotero database using commands like
item get,item notes, anditem context(SKILL.md). - Boundary markers: The documentation does not specify the use of delimiters or instructions to ignore embedded commands within retrieved data.
- Capability inventory: The skill can read local files, interact with the Zotero GUI, and perform experimental SQLite writes (SKILL.md).
- Sanitization: There is no evidence that content retrieved from Zotero is sanitized or escaped before being interpolated into the agent's prompt.
- [COMMAND_EXECUTION]: The skill provides a harness for executing shell commands to control the Zotero application and its local API.
- Evidence: Entry points like
cli-anything-zoteroandpython -m cli_anything.zoteroallow the agent to execute operations such asapp launch,note add, andimport file(SKILL.md).
Audit Metadata