arxiv-zotero-obsidian
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill generally matches its stated purpose (adding arXiv papers to Zotero and writing Obsidian notes) but contains inconsistencies and unexplained defaults (missing declared env requirements, no crawler implementation, hard-coded collection key) that warrant caution.
This skill may do what it says, but there are several mismatches you should address before installing: 1) Clarify required environment variables — the code expects ZOTERO_API_KEY and ZOTERO_USER_ID (and optionally OBSIDIAN_VAULT_PATH/OBSIDIAN_FOLDER) but the registry lists none. Do not run it until you set these yourself. 2) Inspect or remove the default collection key ('U4PZ3XNP') — leaving it may add items to someone else's collection. 3) Confirm how the 'scan arxiv.drqyq.com' step is implemented: the provided helper has no crawler; figure out what component supplies arXiv IDs. 4) Limit the Zotero API key permissions (only give the minimal write scope needed) and preferably test with a throwaway Zotero account or collection. 5) Review the script locally to ensure the OBSIDIAN_VAULT_PATH is correct and to avoid unintended filesystem writes. 6) If you plan to run it on a schedule, first run a single manual invocation and monitor network calls/logs. These inconsistencies look like sloppy packaging rather than obviously malicious behavior, but proceed cautiously.
Static analysis
Static analysis findings are pending for this release.
VirusTotal
No VirusTotal findings
Risk analysis
No visible risk-analysis findings were reported for this release.