Security audit
Security checks for vulnerabilities and agentic risk
This Zotero skill is mostly purpose-aligned, but its automatic PDF download and upload path is under-scoped and can fetch unintended URLs before uploading the result to Zotero.
Review this before installing. Use it only with Zotero API credentials you are comfortable granting write access to, and avoid running it on untrusted or user-supplied URLs until the arXiv URL handling is fixed with strict hostname validation, size/type checks, and explicit opt-in for PDF attachment upload.
scripts/save_paper.py:97Insufficient URL Validation Enables Server-Side Request Forgery and Unintended Data Upload
scripts/save_paper.py:2Automatically Installed Dependency Is Not Reproducibly Pinned
The documented purpose says the skill saves paper metadata and abstracts to Zotero, but the detected behavior also includes downloading PDFs from arXiv, uploading attachments to Zotero, and accessing external network resources beyond Zotero itself. This mismatch is dangerous because reviewers and users may approve the skill under a narrower trust model, while the actual behavior expands data transfer, network exposure, and attachment handling in ways that could leak data or fetch untrusted content.
The skill declares access to an environment secret and performs networked actions, but it does not define any explicit tool scope or permission boundaries. This increases the chance that an agent or runtime will grant broader-than-necessary capabilities, especially since the skill handles ZOTERO_CREDENTIALS and may contact external services.
The CLI description and argument help strings are presented only in Chinese, and the rest of the script's user-facing output follows the same pattern. This imposes a language choice on all users without opt-in or indication that the tool is intentionally limited to a Chinese-speaking context.
The skill behavior exceeds its stated scope by silently downloading a PDF from arXiv and uploading it to Zotero, while the manifest only describes saving papers and abstracts. This creates a transparency and consent problem: users may authorize metadata storage but not expect network retrieval of third-party content and attachment upload, which can have bandwidth, storage, and policy implications.
The code reads ZOTERO_CREDENTIALS from the environment and parses an API key, which is a sensitive credential access path. While the script prints an error when credentials are missing, it does not disclose to the user that it will read and use stored credentials for authenticated API actions.
No suspicious patterns detected.