Security audit

zotero-scholar-finder

Security checks for vulnerabilities and agentic risk

Overview

This Zotero helper mostly does what it says, but its PDF download path is under-scoped and can fetch non-arXiv or local/internal resources before uploading them to Zotero.

Install only if you are comfortable granting the skill write access to your Zotero library. Use a least-privilege Zotero API key, keep ZOTERO_CREDENTIALS secret, and avoid running it on paper URLs from untrusted sources until the arXiv URL validation, download limits, and dependency pinning are tightened.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/save_paper.py:105
Finding: Weak arXiv URL Validation Enables Server-Side Request Forgery and Local File Disclosure
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/save_paper.py:123
Finding: Unbounded PDF Download Can Exhaust Disk and Execution Resources
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/save_paper.py:2
Finding: Unpinned Runtime Dependency Creates a Supply-Chain Exposure
Content: View full analysis
=3.11" # dependencies = ["pyzotero>=1.11.1"] # /// ``` The documented execution method resolves the script environment through `uv`: ```bash uv run {baseDir}/scripts/save_paper.py \ --title "Attention Is All You Need" \ --authors "Vaswani et al." \ --url "https://arxiv.org/abs/1706.03762" ``` ### Technical Analysis The dependency declaration specifies only a minimum version of `pyzotero`. It permits `uv` to select any later compatible release available from the configured package source. No audited lock file, exact version constraint, or package hash is included in the reviewed project. This makes execution non-reproducible and allows the effective dependency code to change after the Skill has been reviewed. If a future release or package-distribution account is compromised, malicious package code could run when the dependency is installed or imported. This finding does not establish that the current `pyzotero` package is malicious. The vulnerability is the project's failure to constrain and integrity-lock the code that will execute at runtime. ### Attack Path 1. A future compatible `pyzotero` release or relevant transitive dependency is compromised, malicious, or unexpectedly vulnerable. 2. The Skill is launched using `uv run`. 3. Dependency resolution selects the affected release because the declaration allows any version at or above `1.11.1`. 4. Package installation or import executes code in the Skill's process context. 5. That code can access environment variables, including `ZOTERO_CREDENTIALS`, as well as files and network resources available to the process. ### Impact Assessment A compromised dependency would execute with the same operating-system privileges ...[truncated 451 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill declares access to environment variables and network-facing behavior, but it does not define an explicit tool scope such as permissions or allowed-tools. This weakens containment and reviewability, making it easier for the skill to access sensitive data like Zotero API credentials and perform outbound requests without clear user-visible restrictions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill instructs users to place a sensitive Zotero API credential in an environment variable, but it provides no warning about secrecy, storage, logging, or least-privilege handling. This increases the risk of accidental exposure through shell history, debug output, screenshots, shared environments, or misuse by the skill or surrounding tooling.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code defines the command description and argument help text only in Chinese, and later user-facing status/error messages are also exclusively Chinese. The policy explicitly flags language/locale constraints when a skill forces a specific language without user opt-in, and this file provides no alternative locale or documented regional justification.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest description is limited to saving a paper into a Zotero library. In addition to creating the Zotero item, the code conditionally fetches a remote PDF from arXiv and attaches it to the entry, which is a broader behavior than the stated description and not an obvious implementation detail of merely saving metadata.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.