openclaw-zotero-new

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:26 AM UTC
• Version: 1.0.0

Overview

The skill is mostly aimed at saving papers to Zotero, but it uses broad install and network behavior that deserves manual review before installation.

Review this before installing. Use a least-privilege Zotero API key, do not expose ZOTERO_CREDENTIALS in logs or shared shells, avoid the shell/PowerShell installer entries unless you trust and verify the uv installer yourself, and only run the script on trusted paper URLs because arXiv detection is loose and may upload fetched content to your Zotero library.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (3)

<![CDATA[T03

Error

• Location: SKILL.md:25

Finding

<![CDATA[Mutable Remote Installer Scripts Are Executed Without Verification]]>

Content

View full analysis

Remediation

View remediation

<![CDATA[T09

Error

• Location: scripts/save_paper.py:92

Finding

<![CDATA[Substring-Based arXiv Validation Allows Arbitrary Resource Retrieval and Upload]]>

Content

View full analysis

Remediation

View remediation

<![CDATA[T08

Warning

• Location: scripts/save_paper.py:2

Finding

<![CDATA[Unpinned Runtime Dependency Permits Unreviewed Future Package Versions]]>

Content

View full analysis

=3.10" # dependencies = ["pyzotero>=1.6.0"] # /// ``` ### Technical Analysis The inline dependency declaration accepts any `pyzotero` release at or above version 1.6.0. No exact version, lockfile, package hash, or other integrity constraint is included in the project. When the documented `uv run` command resolves this dependency, the version installed in the future may differ from the version reviewed today. This is not evidence that `pyzotero` is currently malicious; rather, it creates a supply-chain exposure in which a compromised, unexpectedly changed, or incompatible future release can be installed and imported without a corresponding Skill review. The imported package executes in the same Python process as the Skill and receives the Zotero library identifier and API key through normal API construction. ### Attack Path 1. A future dependency release is compromised, maliciously modified, or otherwise unsafe. 2. The permissive `>=1.6.0` constraint allows the resolver to select that release. 3. A user invokes the documented `uv run` command. 4. `uv` downloads and installs the selected package version. 5. Python imports the package with the privileges and environment access of the Skill process. 6. Malicious package code can access process resources, including the Zotero credential available to the script. ### Impact Assessment A compromised dependency can execute arbitrary Python code with the invoking user's privileges. It could read `ZOTERO_CREDENTIALS`, access user-readable files, modify Zotero data through the supplied credentials, make network requests, or alter local files. The issue increases future supply-chain risk but does not establish that the currently available dependency is malicious. ...[truncated 3 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared purpose says the skill saves papers to Zotero, but the detected behavior goes further by downloading/uploading PDFs and creating note objects. This is dangerous because users may authorize a metadata save while the skill performs additional network fetches and persistent writes to their library that they did not expect.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares environment-variable and network-capable behavior but does not define an explicit tool scope such as permissions or allowed-tools. This weakens user and platform visibility into what the skill can access, increasing the chance that credentials are read and outbound requests are made without clear consent boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs users to provide Zotero credentials via an environment variable and even specifies the credential format, but gives no warning that this secret grants write access to the user's library. Poor secret-handling guidance increases the risk of accidental exposure through logs, shell history, screenshots, or reuse in unsafe environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill says it can save metadata, PDF links, and AI-generated summaries into the user's Zotero library without clearly warning that it performs write operations on user data. Hidden or underemphasized write behavior can lead to unintended modification of a personal research library and trust violations when AI-generated content is stored automatically.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The argparse description, argument help text, and subsequent user-facing output are written entirely in Chinese, which imposes a specific language on all users. The file does not provide any language selection, opt-in mechanism, or documented reason that the skill is intended only for a Chinese-speaking or region-specific context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill behavior exceeds its stated scope: instead of only saving metadata to Zotero, it also performs a network download from arXiv and uploads the resulting file as an attachment. This hidden side effect matters because users and callers may approve a metadata-save action without realizing the skill will fetch remote content, consume bandwidth/storage, and persist external files into their library.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The installation metadata uses a curl-piped-to-shell pattern to fetch and immediately execute a remote script. If the remote host, transport, or script supply chain is compromised, arbitrary code will run on the user's machine during installation.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md

{
      "id": "uv-linux",
      "kind": "shell",
      "script": "curl -Ls https://astral.sh/uv/install.sh | sh",
      "bins": ["uv"],
      "platform": "linux",
      "label": "Install uv via install script"

Static analysis

No suspicious patterns detected.