zotero-sholar
PassAudited by ClawScan on May 10, 2026.
Overview
This skill appears to do what it says—save user-provided paper details, summaries, and optional arXiv PDFs to Zotero—but it needs a Zotero API key and can write to the user's library.
Install only if you are comfortable giving this skill a Zotero API key that can add content to your library. Use a minimally scoped Zotero key, pass trusted paper URLs, and review generated summaries before saving them.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Anyone running the skill with a valid API key can add records, notes, and attachments to the configured Zotero account.
The script uses a Zotero API key from the environment to create items in the user's Zotero library, which is expected for the skill but grants account write authority.
zotero_creds = os.environ.get('ZOTERO_CREDENTIALS') ... zot = zotero.Zotero(library_id, library_type, api_key) ... resp = zot.create_items([template])Use a Zotero API key with only the permissions needed for this workflow, keep it private, and revoke it if the skill is no longer used.
A mistaken or untrusted URL could cause the skill to fetch and attach unintended content to Zotero.
The skill automatically downloads a PDF based on the supplied URL and uploads it as a Zotero attachment. This is purpose-aligned, but the URL check is a simple substring match.
if 'arxiv.org' in args.url: ... urllib.request.urlretrieve(pdf_url, pdf_path) ... zot.attachment_simple([pdf_path], item_key)
Only use trusted paper URLs, and ideally validate that arXiv PDF downloads use an https://arxiv.org host before fetching.
The behavior depends on the installed pyzotero package version and package index integrity.
The skill discloses that uv will install the pyzotero dependency at runtime. This is normal for the workflow but still relies on an external package source.
执行 `uv run` 时会自动安装 `pyzotero`。
Run it in a trusted environment and consider pinning or reviewing dependencies for production or sensitive Zotero libraries.
Incorrect, private, or prompt-like summary text could become part of the user's long-term Zotero library.
The skill stores the provided AI-generated summary as a persistent Zotero note. This is expected, but users may later trust or reuse that stored summary.
note_template['note'] = f"<h3>AI 摘要</h3><p>{args.summary}</p>" ... zot.create_items([note_template])Review AI-generated summaries before saving, especially if Zotero notes are later used as research context.