Security audit
Security checks for vulnerabilities and agentic risk
The skill is a disclosed Zenodo API helper whose token use, uploads, and publishing actions fit its research-deposit purpose, though production publishing remains irreversible.
Install only if you intend to let the agent work with your Zenodo account. Prefer sandbox tokens first, keep production tokens limited to the required scopes, review files and metadata before publish, and require explicit confirmation for any production publish or draft file deletion.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
prerequisites:
- curl on PATH
- ZENODO_TOKEN environment variable (personal access token with deposit:write and deposit:actions scopes)
- Optional: jq for the example shell scripts
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
prerequisites:
- curl on PATH
- ZENODO_TOKEN environment variable (personal access token with deposit:write and deposit:actions scopes)
- Optional: jq for the example shell scripts
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
## Features
- **Full deposit lifecycle** — create deposition → upload files via the bucket API → set metadata → publish
- **New version workflow** — release updated data/code under the same concept-DOI
- **Search** — Elasticsearch-style queries against published records (no auth required)
- **Sandbox-first** — defaults to `sandbox.zenodo.org` so you don't accidentally publish irreversibly to production
The trigger phrases are broad enough that the skill may activate on loosely related Zenodo mentions and steer the agent into deposit/publish workflows without tight intent validation. In a skill that can create records, upload files, and publish irreversible production releases, ambiguous activation increases the chance of unintended sensitive actions or unnecessary collection/use of tokens and local artifacts.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
mkdir -p ~/.claude/skills
git clone https://github.com/Agents365-ai/zenodo-skill ~/.claude/skills/zenodo-skill
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
mkdir -p ~/.claude/skills
git clone https://github.com/Agents365-ai/zenodo-skill ~/.claude/skills/zenodo-skill
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
mkdir -p ~/.claude/skills
git clone https://github.com/Agents365-ai/zenodo-skill ~/.claude/skills/zenodo-skill
README 将触发方式描述为任意自然语言需求描述，并给出的示例都是普通口语化请求，这会增加与日常对话或泛化上传/检索请求发生误触发的风险。文档中没有列出更严格的触发短语、适用范围限制或负面示例来说明哪些请求不应激活该技能。
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -sS -X POST "$ZENODO_BASE/deposit/depositions" \
-H "Authorization: Bearer $ZENODO_TOKEN" \
-H "Content-Type: application/json" \
-d '{}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
The bucket API supports up to 50 GB total / 100 files per record. Use --upload-file (HTTP PUT) — not multipart form upload. The filename in the URL is what shows up on the record.
curl -sS --upload-file ./data.csv \
-H "Authorization: Bearer $ZENODO_TOKEN" \
"$BUCKET/data.csv"
The skill enables implicit invocation without defining tight trigger constraints or exclusions, which can cause the agent to activate automatically on broad mentions of Zenodo-related tasks. Because this skill can publish records and mint DOIs, unintended invocation could trigger sensitive or irreversible actions with the user's configured token.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
set -euo pipefail
# 1. Create empty deposition
RESP=$(curl -sS -X POST "$ZENODO_BASE/deposit/depositions" \
-H "Authorization: Bearer $ZENODO_TOKEN" \
-H "Content-Type: application/json" -d '{}')
DEPOSIT_ID=$(echo "$RESP" | jq -r .id)
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# 2. Upload all files in ./data/
for f in ./data/*; do
name=$(basename "$f")
curl -sS --upload-file "$f" \
-H "Authorization: Bearer $ZENODO_TOKEN" \
"$BUCKET/$name" > /dev/null
echo "uploaded $name"
The example performs a destructive DELETE of an inherited file in a new Zenodo draft without any confirmation, preview, or warning. In a publishing workflow, users may copy-paste this command and accidentally remove the wrong file from a versioned release, causing integrity and availability issues for the deposited artifact.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
BUCKET=$(echo "$DRAFT" | jq -r .links.bucket)
# Optional: delete an inherited file you want to replace
curl -sS -X DELETE "$BUCKET/old-data.csv" -H "Authorization: Bearer $ZENODO_TOKEN"
# Upload new file
curl -sS --upload-file ./new-data.csv \
No suspicious patterns detected.