social media scholar (zotero)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:56 AM UTC
• Version: 1.0.3

Overview

This Zotero importer matches its stated purpose, but it needs Review because it can use stored credentials to write to Zotero and upload weakly validated downloaded attachments.

Install only if you are comfortable granting the skill access to your Zotero API credentials and allowing it to create items, notes, and attachments in your Zotero library. Use it with explicit save-to-Zotero requests, avoid untrusted or shortened paper URLs, and review created attachments because crafted URLs containing arxiv.org could cause non-paper content to be uploaded.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/save_paper.py:117

Finding

Weak arXiv URL Validation Permits Attacker-Controlled File Retrieval

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: SKILL.md:23

Finding

Third-Party Dependency Is Installed Without an Exact Version or Integrity Hash

Content

View full analysis

=3.10" # dependencies = ["pyzotero>=1.6.0"] # /// ``` ### Technical Analysis The Skill installs and imports the third-party `pyzotero` package without requiring an exact reviewed version or verifying an integrity hash. The installation metadata and documented command allow any current release, while the inline script metadata only establishes a lower version bound. Consequently, the effective code installed and executed can change after the Skill itself has been reviewed. A future compromised, malicious, or unexpectedly incompatible release satisfying the dependency declaration could be selected automatically. The package name is consistent across the project, and the audit found no suspicious custom package index, typo-squatted name, or direct evidence that `pyzotero` itself is malicious. The issue is therefore dependency-integrity risk rather than evidence of an intentionally malicious dependency. ### Attack Path 1. A user or automation framework follows the Skill's installation metadata or runs `pip install pyzotero`. 2. The package resolver selects the latest available version, or any version satisfying `pyzotero>=1.6.0`. 3. If the upstream package, maintainer account, distribution infrastructure, or selected release has been compromised, unreviewed package code is downloaded. 4. Package installation or subsequent import execu ...[truncated 990 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared purpose understates the real behavior: the skill reads credentials from Keychain or environment variables, downloads external content such as PDFs, and uploads data and attachments into Zotero. This mismatch is dangerous because users may consent to citation extraction without realizing the skill can access secrets, fetch remote content, and persist data to third-party services.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/save_paper.py (reported line 26)May include surrounding context.

python

library_id = None
    api_key = None

    # 优先从 macOS Keychain 读取（格式：library_id:api_key）
    import subprocess
    try:
        result = subprocess.run(

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill requires environment access, network access, and shell execution, but it does not declare an explicit tool scope or allowed-tools boundary. That creates an authorization gap where the agent may use broader capabilities than users or the runtime expect, especially because the skill also handles credentials and performs external writes to Zotero.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The activation language is broad and ambiguous, making it easier for the skill to trigger on loosely related user inputs and perform unintended Zotero writes or page scraping. In a skill that can access credentials and external URLs, overbroad triggering materially increases the chance of surprising or unauthorized actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description does not clearly warn users that it will write records into Zotero and may automatically fetch and attach external content. This is dangerous because users may provide a link expecting analysis only, while the skill persists data and attachments to their library using stored credentials.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill directs browser automation to navigate arbitrary social-media pages and scrape full page contents, which is broader than the stated task of extracting citation metadata. In context, this increases risk of collecting unrelated personal or account-linked content from pages and expands the attack surface to any user-supplied URL.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The user-facing argparse description and option help strings are entirely in Chinese, which imposes a specific language on all users of the skill. The file does not indicate that the skill is intended only for a Chinese-speaking environment or provide any opt-in or alternative locale.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The stated purpose is to extract paper info from links and save it to Zotero. Spawning a platform-specific system command to access OS credential storage is an additional capability not reflected in the skill description and is not inherent to the user-facing purpose as stated.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/save_paper.py (reported line 29)May include surrounding context.

python

# 优先从 macOS Keychain 读取（格式：library_id:api_key）
    import subprocess
    try:
        result = subprocess.run(
            ['security', 'find-generic-password', '-s', 'openclaw-zotero', '-w'],
            capture_output=True, text=True, timeout=5
        )

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script performs network retrieval and attachment upload beyond the core metadata-save behavior, which increases the skill's capability and trust requirements. Because it derives the download URL from user-controlled args.url using a weak substring check, an attacker can trigger unexpected outbound requests and potentially upload non-paper content into the user's Zotero library if a crafted URL contains arxiv.org.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest says the skill extracts paper information from social-media posts and saves the paper to Zotero. The scraping guidance and note template also call out collecting GitHub links and storing them in the generated note, which extends the skill into code-resource harvesting rather than paper-only ingestion.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.