Security audit

zotero-scholar

Security checks for vulnerabilities and agentic risk

Overview

This Zotero helper fits its stated purpose, but it needs review because it uses a Zotero API key and can fetch and upload content from insufficiently validated URLs.

Review this before installing. Use a narrowly scoped Zotero API key, avoid exposing ZOTERO_CREDENTIALS in prompts or logs, pass only trusted HTTPS Zotero/arXiv URLs, and consider requiring exact dependency pinning plus strict arXiv URL validation before routine use.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/save_paper.py:98
Finding: Insufficient arXiv URL Validation Enables Unintended Network Requests
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/save_paper.py:2
Finding: Unpinned Dependency Is Dynamically Resolved at Runtime
Content: View full analysis
=3.10" # dependencies = ["pyzotero>=1.6.0"] # /// ``` `SKILL.md`: ```bash uv run {baseDir}/scripts/save_paper.py \ --title "Attention Is All You Need" \ --authors "Vaswani et al." \ --url "https://arxiv.org/abs/1706.03762" ``` ### Technical Analysis The inline dependency declaration specifies only a minimum version of `pyzotero`. The documented `uv run` invocation may therefore resolve and download a newer package release at execution time. No reviewed lockfile, exact version constraint, or package hash is present in the audited project. This makes execution non-reproducible and causes the effective trusted codebase to vary after the skill itself has been reviewed. A future compromised package release, compromised distribution account, or unsafe package source could introduce code that executes when the package is installed or imported. This finding does not establish that the current `pyzotero` package is malicious. The vulnerability is the project's unrestricted acceptance of future versions without integrity pinning. ### Attack Path 1. The skill is invoked through the documented `uv run` command in an environment where the dependency is not already fixed in a trusted cache. 2. `uv` resolves a version satisfying `pyzotero>=1.6.0`. 3. A future compromised or otherwise malicious version satisfies that range and is selected from the configured package source. 4. The selected package is downloaded and installed without validation against a project-controlled lockfile or expected hash. 5. Package code executes during import or normal use with the privileges and environment of the skill process. ### Impact ...[truncated 526 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill invokes code that uses both environment variables and network access, but it does not declare any explicit tool scope such as allowed tools or permissions. This weakens security review and runtime policy enforcement because users and hosting systems cannot clearly see or constrain that the skill will read credentials and send data over the network.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs users to place a Zotero userid and API key in an environment variable but provides no warning about sensitive-secret handling, storage, logging, or exposure risks. Because the skill also performs networked operations, mishandling of this credential could lead to unauthorized access to the user's Zotero library or accidental leakage through process output, shell history, or agent telemetry.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script's natural-language interface, including the command description and argument help strings, is entirely in Chinese. This imposes a specific language on users without opt-in or any documented justification for a locale-specific constraint.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill behavior exceeds its stated scope: instead of only saving bibliographic metadata to Zotero, it also performs a network download from arXiv and uploads the resulting PDF as an attachment. This can surprise users, increase network and storage side effects, and create trust and policy issues because unadvertised remote retrieval occurs based on user-controlled input.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The natural-language instructions and parameter descriptions are presented in Chinese throughout the skill file, which can amount to forcing a specific language without user opt-in. The file does not state that the skill is intentionally Chinese-only or provide an alternative language option.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The code accesses sensitive credentials via ZOTERO_CREDENTIALS, but there is no explicit disclosure in comments, help text, or the parser description that the script will read API credentials from the environment. The later error message explains how to set the variable if missing, but it does not serve as a proactive warning about sensitive credential access during normal use.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.