Security audit

zotero-myscholar

Security checks for vulnerabilities and agentic risk

Overview

This Zotero helper has a coherent goal, but the shipped script contains a credential-shaped secret, does not match its credential documentation, and can automatically download and upload poorly validated URLs.

Review this carefully before installing. Use a narrowly scoped Zotero API key, rotate any key matching the exposed credential-shaped string if it is real, and avoid running the script on untrusted URLs until the credential lookup, arXiv host validation, download limits, and attachment opt-in behavior are fixed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/save_paper.py:24
Finding: Exposed Zotero API Credential in Source Code
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/save_paper.py:91
Finding: Server-Side Request Forgery Through Insufficient arXiv URL Validation
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/save_paper.py:2
Finding: Unpinned Runtime Dependency Allows Unreviewed Package Updates
Content: View full analysis
=3.10" # dependencies = ["pyzotero>=1.6.0"] # /// ``` ### Technical Analysis The inline dependency declaration accepts any `pyzotero` version greater than or equal to `1.6.0`. No lockfile, exact version, or integrity hash is present in the audited project. When the script is executed through `uv run`, dependency resolution may select a newer package release that was not reviewed when this skill was audited. This creates a non-reproducible execution environment and increases exposure to compromised upstream releases, malicious maintainer activity, or incompatible future changes. No evidence was found that the currently named `pyzotero` package is malicious. The finding concerns unsafe dependency resolution rather than a confirmed malicious package. ### Attack Path 1. A compromised maintainer account or upstream package infrastructure publishes a malicious `pyzotero` release satisfying `>=1.6.0`. 2. A user runs the skill in an environment that has not already locked or cached a known-good release. 3. `uv` resolves and installs the malicious compatible release. 4. Python imports the package through `from pyzotero import zotero`. 5. Package initialization or invoked package functions execute with the privileges of the user running the skill. 6. The malicious dependency may access the Zotero credential, local files available to that user, and the process's network connections. ### Impact Assessment A compromised dependency could execute arbitrary Python code with the operating-system privileges of the skill process. It could potentially read runtime secrets, modify user-accessible files, alter Zotero operations, or send data over the network. The practical likelihood depends on an upstream compromise or unsafe future release. T ...[truncated 77 chars]
Remediation: View remediation
"] ``` 2. Generate and commit a `uv` lockfile where the execution model supports it. 3. Require package hashes or other integrity verification in the dependency installation process. 4. Use a controlled package index or internal mirror for production execution. 5. Automate vulnerability and provenance scanning for dependencies. 6. Update the pinned version only through a reviewed dependency-update process. 7. Run the skill in a least-privileged environment with restricted filesystem and network access to reduce the impact of a supply-chain compromise. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documented behavior materially understates what the code actually does: it searches Zotero, creates notes, downloads remote PDFs from arXiv, and uploads attachments. Hidden or underdocumented network/file operations are dangerous because they can cause unintended data transfer, consume resources, and exceed the trust boundary the user believed they were granting.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script claims to use the ZOTERO_CREDENTIALS environment variable but actually calls os.environ.get() with a hardcoded string that looks like a real Zotero userID:API-key pair. This can embed a secret identifier in source code, break expected credential handling, and may cause accidental credential disclosure or unauthorized use if the hardcoded value corresponds to a real account.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill uses sensitive capabilities—environment variable access for Zotero credentials and outbound network access to Zotero/arXiv—but the manifest does not declare a tool/permission scope. This weakens user consent and review because operators cannot easily see that the skill will access secrets and perform external network actions.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill presents itself as a Zotero save helper, but the code also fetches content from arXiv and uploads it as an attachment. This is a scope expansion beyond the stated purpose and can surprise users with extra external requests and content ingestion they did not explicitly authorize.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description is written as an instruction in Chinese and does not provide any language choice or note that the skill is region- or locale-specific. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation suggests only storing PDF links, but the implementation downloads the full PDF and re-uploads it to Zotero for arXiv URLs. That distinction matters because downloading and storing third-party files changes the privacy, bandwidth, storage, and content-handling risk profile.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This code reads a credential-like value from the environment and uses it to authenticate to Zotero, then sends bibliographic data to a remote service. While some progress messages exist later, there is no clear warning at the point of credential access or before transmitting user-supplied paper metadata over the network.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script automatically downloads a PDF from a URL derived from user input and uploads it to Zotero without explicit confirmation. In an agent-skill context, this creates unreviewed outbound and inbound network activity, which can be abused to fetch unexpected content, consume resources, or attach unwanted files to a user's library.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script's CLI description, argument help, and runtime messages are all presented in Chinese, which imposes a specific language on users without opt-in or documented locale scope. This matches the policy category for language or locale constraints lacking user choice.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.