zotero-scholar
v0.0.2Save academic papers with metadata, PDF links, and AI summaries to your Zotero library using credentials set in ZOTERO_CREDENTIALS (userid:apiKey).
⭐ 0· 1.1k·10 current·13 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (save papers to Zotero) matches the code and required env var (ZOTERO_CREDENTIALS). The script uses the pyzotero library and the ZOTERO_CREDENTIALS (userid:apiKey) to create items and attach PDFs—this is consistent with the stated purpose. The only mild oddity: the skill requires a 'uv' binary to run the script instead of invoking python directly; this is a convenience/runtime choice rather than a mismatch in capability.
Instruction Scope
SKILL.md instructs running the included script via 'uv run' and to set ZOTERO_CREDENTIALS. The script only reads that env var and the provided CLI arguments; it does not attempt to read unrelated files, other environment variables, or contact endpoints outside of Zotero and (optionally) arXiv for PDF downloads. No open-ended or vague instructions that grant broad discretionary data access.
Install Mechanism
Install spec only installs a Homebrew formula 'uv' (creates a uv binary). This is a low-risk, package-manager-based install, but 'uv' is an uncommon binary name—verify the formula/source before installing. The script declares a Python dependency (pyzotero>=1.6.0) in its header, but the install spec does not install Python packages; the user will need to ensure pyzotero is present in the runtime environment (e.g., pip install pyzotero).
Credentials
Only ZOTERO_CREDENTIALS is required and used by the script; that credential is necessary and proportionate for creating items in a Zotero user library. No extra or unrelated secrets/config paths are requested.
Persistence & Privilege
The skill is not always-enabled and does not request elevated or persistent platform-wide privileges. It does not modify other skills or global agent settings; file writes are limited to a temporary directory when downloading PDFs.
Assessment
This skill appears to do exactly what it says: create Zotero items (and optionally attach PDFs) using ZOTERO_CREDENTIALS in the format userID:apiKey. Before installing, verify the source of the Homebrew 'uv' formula (it's an uncommon package name) and ensure your runtime has Python and the pyzotero package installed. Keep your ZOTERO_CREDENTIALS secret—the script will use them to write to your Zotero library. Note that arXiv PDF downloads and uploads happen temporarily on disk and then are uploaded to Zotero; the temporary files are removed, but the upload requires network access. If you are uncomfortable granting write access to your Zotero account, do not install or provide credentials.Like a lobster shell, security has layers — review code before you run it.
latestvk974rnct9by6atkcp94pvkg2fx817fjx
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📚 Clawdis
Binsuv
EnvZOTERO_CREDENTIALS
Primary envZOTERO_CREDENTIALS
Install
Install uv (brew)
Bins: uv
brew install uv