zotero-scholar

• Analyzed: May 12, 2026, 4:04 AM
• Findings: 1
• Version: 0.0.2
• Hash: 5c691a22ba5b9ef54a92dff6ff5bab726c98b535fae151720f3f5d4b912d1936
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is designed to save academic papers to a user's Zotero library. It reads Zotero API credentials from the `ZOTERO_CREDENTIALS` environment variable, which is necessary for its stated function. The Python script interacts with the Zotero API to create entries and notes, and conditionally downloads PDFs from `arxiv.org` URLs to attach them. There is no evidence of intentional data exfiltration beyond using the provided Zotero credentials for their intended purpose, no malicious execution, persistence mechanisms, or prompt injection attempts against the agent in `SKILL.md`. All network and file system interactions are directly related to the skill's described functionality.