Pyzotero
v2.2.0Python scripts for Zotero - supports search, browse, add items, and full collection management. Both local API and online Web API modes.
⭐ 3· 1.9k·10 current·12 all-time
byKGTAF@killgfat
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description (pyzotero CLI for Zotero local/online APIs) match the included code and instructions: scripts call the pyzotero library, support search, list collections, add items, and collection management. Declared required binaries (python3, pyzotero) are appropriate for the stated purpose.
Instruction Scope
SKILL.md and other docs instruct running the included Python scripts, calling the local Zotero local API or the Zotero Web API, and setting environment variables for online mode. Instructions reference absolute paths inside the OpenClaw workspace and show examples that run subprocesses — expected for a CLI skill but worth noting because the skill will execute local commands and call network APIs. No instructions attempt to read unrelated system files or transmit data to unknown endpoints.
Install Mechanism
There is no automated install spec in the registry (instruction-only), and the docs recommend installing the upstream pyzotero package via pipx or pip. That is a low-to-moderate risk approach; the skill does include code files (scripts/) which will be present in the skill folder, but there is no downloader URL or archive extraction in the install metadata.
Credentials
Online mode legitimately requires secrets (ZOTERO_USER_ID and ZOTERO_API_KEY) and the documentation instructs setting them. However, the registry metadata lists no required environment variables and no primary credential — a minor inconsistency. Requesting the Zotero API key is proportional to the stated functionality, but users should be aware the skill will read those env vars if switched to online mode.
Persistence & Privilege
Skill is not always-included and does not request special system privileges. The docs show optional user instructions to create a wrapper in /usr/local/bin (requires sudo) but the skill does not automatically write system-wide files or modify other skills' configs.
Assessment
This skill is consistent with a Zotero CLI wrapper: it runs local Python scripts that call the pyzotero library and either the Zotero local API or the Zotero Web API. Before installing: 1) Review the included scripts (scripts/zotero_tool.py) yourself — the skill will execute them and they perform network calls and read environment variables. 2) If you plan to use online mode, only set ZOTERO_API_KEY and ZOTERO_USER_ID when you trust the environment; avoid committing API keys into shell startup files if you don't want them stored in plaintext history. 3) The registry metadata did not declare required env vars even though the docs describe them; this is likely because local mode is default, but confirm you understand which mode you'll use. 4) Installing the upstream pyzotero package via pipx (recommended) is sensible; do not blindly run commands that write to /usr/local without checking. If you want higher assurance, run the scripts in a sandboxed environment or inspect all code paths that create items (add/create_items) to ensure they behave as you expect.Like a lobster shell, security has layers — review code before you run it.
latestvk97empe26bccw9bwsz3vkn6hwh81zbes
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📚 Clawdis
Binspython3
Any binpyzotero
