Security audit

zotero-openclaw

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly matches its Zotero-saving purpose, but it needs review because it can automatically download a PDF from a loosely checked URL and upload it to your Zotero account.

Install only if you trust the workflow and are comfortable giving it Zotero API access. Use a minimally scoped Zotero key, avoid passing untrusted or copied URLs into the tool, and review the PDF attachment behavior before use because malformed URLs could trigger unintended downloads and uploads. A safer version should strictly validate arxiv.org HTTPS URLs, add size and timeout limits, and make PDF attachment explicit.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/save_paper.py:96
Finding: Insufficient URL Validation Enables Server-Side Request Forgery and Unintended Data Upload
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/save_paper.py:4
Finding: Unpinned Third-Party Dependency Creates a Mutable Supply-Chain Risk
Content: View full analysis
=1.6.0"] ``` The installation documentation also instructs users to install the package without a version or integrity constraint: ```bash pip install pyzotero ``` ### Technical Analysis The dependency declaration only supplies a lower version bound, while the documented installation command supplies no version constraint at all. Dependency resolution can therefore select a future release that was not part of this audit. Python packages and their transitive dependencies may execute code during installation or when imported. If a future package release, transitive dependency, configured package index, or distribution account is compromised, users following these instructions could install and execute unauthorized code with their own privileges. The package name does not appear to be a demonstrated typosquat, and the audited files contain no evidence that the current dependency is malicious. The confirmed weakness is that installation is mutable and lacks version and artifact integrity controls. ### Attack Path 1. A user follows the Skill documentation or uses tooling that interprets the inline dependency declaration. 2. `pip` or another resolver queries its configured package index. 3. The resolver selects the newest compatible package and transitive dependencies rather than a specifically audited artifact. 4. A compromised, malicious, or unexpectedly incompatible release is downloaded. 5. Package installation or import executes the dependency's code with the privileges and environment access of the user running the Skill. 6. Such code could access the Skill's environment, including `ZOTERO_CREDENTIALS`, local files readabl ...[truncated 570 chars]
Remediation: View remediation
"] ``` The exact version should also be accompanied by hashes for the approved distribution artifacts rather than relying on version pinning alone. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill appears to require access to environment variables and network capabilities, but it does not explicitly declare a tool scope such as permissions or allowed-tools. This creates a governance and containment gap: a user or platform cannot easily see or restrict what the skill is expected to access, increasing the chance of over-privileged execution or unnoticed credential/network use.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs users to place Zotero API credentials in an environment variable but provides no warning about keeping the secret private, avoiding logging, and limiting reuse. In a skill that invokes scripts and networked API access, this omission increases the risk of accidental credential disclosure through shell history, debugging output, screenshots, shared terminal sessions, or unsafe downstream code.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The argument parser description and help strings are all written in Chinese, and all user-facing status/error messages in the script are likewise Chinese. This creates a natural-language locale constraint for the skill without offering a language choice or documenting that the tool is intentionally region-specific.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill description says it saves papers to Zotero, but the implementation also downloads PDFs from arXiv and uploads them as attachments. This is a real capability expansion beyond the declared purpose, which increases data transfer, storage, and network-side effects without clear user disclosure or explicit opt-in.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The code performs external network retrieval based on user-supplied URL content and then uploads the fetched file into Zotero. Although it is restricted to URLs containing 'arxiv.org', the capability is still under-disclosed and creates unexpected outbound network access and content ingestion, which can be abused for unwanted downloads or policy bypass in constrained environments.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The natural-language instructions and examples are presented entirely in Chinese, which effectively forces a specific language for users without any opt-in or explanation of a region-specific requirement. Under the stated policy, a skill should either offer language choice or clearly document why a locale constraint is necessary.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.