openclaw-zotero-new

将论文保存到 Zotero 文库，请按照 userid:apiKey 的格式配置 ZOTERO_CREDENTIALS 环境变量。

Security Scan

The skill's code and runtime instructions align with its stated purpose (saving papers to a Zotero library) and only require a Zotero userid:apiKey credential; the only notable risk is the install path that fetches a third-party install script for the 'uv' runner.

Purpose & Capability

Name/description, required env var (ZOTERO_CREDENTIALS), and code all match: the script reads ZOTERO_CREDENTIALS, uses pyzotero to create/check items, attach PDFs, and add notes. Requiring a CLI runner ('uv') is reasonable given the SKILL.md examples use 'uv run', though the script itself could run with Python directly.

Instruction Scope

SKILL.md instructs running the provided script with uv and the script's behavior stays within scope: it only reads ZOTERO_CREDENTIALS (declared), the CLI args, interacts with the Zotero API via pyzotero, and downloads PDFs only for arXiv links. It does not read unrelated files or environment variables, nor does it transmit data to unexpected endpoints.

Install Mechanism

macOS install via Homebrew is standard, but the Linux and Windows install steps run remote install scripts from https://astral.sh (curl | sh and PowerShell invoke-expression). Download-and-execute install scripts from third-party hosts are higher risk and should be reviewed before running. The uv project may be legitimate, but this install pattern warrants caution.

Credentials

Only ZOTERO_CREDENTIALS (userid:apiKey) is required and used as the primary credential. That matches the skill's purpose and nothing else in the code accesses unrelated secrets or config.

Persistence & Privilege

The skill does not request permanent/global presence (always:false) and does not attempt to modify other skills or system-wide config. Autonomous invocation is allowed (platform default) but is not combined with other concerning privileges.

Assessment

This skill appears to do what it says: it will use the ZOTERO_CREDENTIALS (format userID:apiKey) to create or skip Zotero items, add a note, and attach arXiv PDFs when applicable. Before installing or running: (1) keep your Zotero API key secret — the script uses it directly; (2) prefer running the Python script directly (pip install pyzotero) if you don't want to install 'uv'; (3) if you do use the provided installer on Linux/Windows, review the remote install script at https://astral.sh before running because it executes code fetched from the network; and (4) if you need higher assurance, inspect the install script and/or run the Python script in an isolated environment (container) and verify pyzotero dependency installation yourself.

Zotero Scholar

专业的文献入库助手。可以将论文元数据、PDF 链接以及 AI 生成的总结一键保存到你的 Zotero 库中。

使用示例

可以读取环境变量 ZOTERO_CREDENTIALS 中的 Zotero 凭据，格式为 userid:apiKey。

使用环境变量运行

uv run {baseDir}/scripts/save_paper.py \
  --title "Attention Is All You Need" \
  --authors "Vaswani et al." \
  --url "https://arxiv.org/abs/1706.03762"

参数说明

参数	说明
--title	论文标题
--authors	作者列表（逗号分隔）
--url	论文链接 (用于排重)
--abstract	论文摘要
--summary	(AI 生成) 简短总结或 Insight
--tags	标签列表（逗号分隔）