papersgpt-for-zotero

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:11 AM UTC
• Version: 1.0.1

Overview

The skill is coherent for searching a Zotero library, but it asks users to install an unpinned external npm package that will index private local documents in a background process.

Review and trust the npm package before installing, prefer a pinned version from a verified source, and run it with access limited to the Zotero directory you intend to index. Check where it stores indexes, whether it uses the network, and how to delete indexed data before pointing it at private papers or notes.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Unpinned Third-Party npm Package Receives Access to Private Zotero Documents

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20–27 and 37–45
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

The Skill directs users to install the latest available release of an external npm package without pinning a reviewed version or verifying its integrity. It subsequently instructs users to grant the installed software access to a Zotero storage directory containing potentially private papers and notes.

Relevant code:

markdown

## Installation
You can install PapersGPT for Zotero globally using npm. This will make the `pz` and `pgz` commands available in your terminal.

```bash
npm install papersgpt-for-zotero

After installation, ensure that you have your Zotero storage directory accessible and you are ready to use the pz command. More information please see https://github.com/papersgpt/papersgpt-for-zotero.

text

```markdown
1. **Initialize**: Run `pz init` once to link your Zotero storage and start the background indexing process.
   ```bash
   # Initialize with default Zotero path
   pz init

   # Initialize with a custom path
   pz init "/Users/name/Documents/Zotero/storage"
   ```

Technical Analysis

The command npm install papersgpt-for-zotero does not specify an exact package version or integrity digest. Consequently, the code installed depends on the package version published under that name at installation time. npm packages can also define lifecycle scripts that execute during installation with the permissions of the invoking user.

After installation, pz init is expected to access and index the user's Zotero storage. This creates a supply-chain trust boundary: an external package that is not included in the audited project is granted access to potentially sensitive local documents. The project contains only SKILL.md, so the package's lifecycle scripts, network communication, local data handling, background service, and ind ...[truncated 1703 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the installation command to an exact, reviewed package version rather than implicitly installing the latest release.
2. Record and verify the npm registry integrity value for the approved package artifact.
3. Commit a lockfile where the installation workflow permits it, and use a reproducible installation command such as npm ci.
4. Audit the package source, transitive dependencies, and npm lifecycle scripts before recommending installation.
5. Publish the relevant implementation with the Skill or link to an immutable source revision so reviewers can verify the code corresponding to the pinned package.
6. Document all expected network destinations, telemetry behavior, local index locations, file permissions, and retention policies.
7. Recommend installation and execution under a dedicated, least-privileged account or sandbox with access limited to the required Zotero directory.
8. Disable npm lifecycle scripts during installation when they are unnecessary, or explicitly document and review every required script.
9. Add package provenance or signature verification and establish a controlled update process requiring security review before changing the approved version.
10. Correct the installation documentation if global installation is intended, because the stated global behavior does not match the displayed command.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.