zotero-skills

PassAudited by ClawScan on May 1, 2026.

Overview

This skill appears to do what it claims: it uses a Zotero API key to add paper records, optional summaries, and arXiv PDFs to your Zotero library.

This skill is reasonable for saving papers to Zotero, but only configure a Zotero API key you are comfortable granting write access to, and review generated summaries or tags before saving them.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Installing and using the skill gives it delegated access to create Zotero library content with the configured API key.

Why it was flagged

The skill requires a Zotero user ID and API key so it can act on the user's Zotero library.

Skill content
可以读取环境变量 `ZOTERO_CREDENTIALS` 中的 Zotero 凭据,格式为 `userid:apiKey`。
Recommendation

Use a Zotero API key with only the permissions needed for this workflow and rotate or revoke it if you stop using the skill.

What this means

A run of this skill can add persistent content to your Zotero account, though the behavior matches the stated purpose and avoids overwriting existing matching items.

Why it was flagged

The script performs write operations against Zotero by creating an item, optionally adding a note, and optionally uploading a PDF attachment.

Skill content
resp = zot.create_items([template]) ... zot.create_items([note_template]) ... zot.attachment_simple([pdf_path], item_key)
Recommendation

Review the paper title, URL, tags, and summary before invoking the skill if you want to avoid unwanted library entries.

What this means

The installed pyzotero version may vary over time, which can affect reproducibility and supply-chain review.

Why it was flagged

The script relies on a third-party Python package using a version lower bound rather than an exact pinned version.

Skill content
# dependencies = ["pyzotero>=1.6.0"]
Recommendation

Prefer a pinned dependency or reviewed lockfile if you need reproducible installs.

What this means

Any inaccurate, sensitive, or prompt-like content in the generated summary can persist in Zotero and may be seen or reused later.

Why it was flagged

The skill can store an AI-generated summary as a persistent Zotero note attached to the created item.

Skill content
note_template['note'] = f"<h3>AI 摘要</h3><p>{args.summary}</p>"
Recommendation

Review generated summaries before saving them, especially for sensitive or unpublished research.