zotero-openclaw

将论文保存到 Zotero 文库，请按照 userid:apiKey 的格式配置 ZOTERO_CREDENTIALS 环境变量。

Security Scan

The skill's code, requirements, and instructions are consistent with its stated purpose (saving papers to a Zotero library) and request only the Zotero credential it needs.

Purpose & Capability

The skill is named and described as a Zotero paper-saver, requires Python and a ZOTERO_CREDENTIALS environment variable, and the included script uses pyzotero and that credential to write to Zotero — this is proportionate and expected.

Instruction Scope

SKILL.md directs the agent to run the provided Python script and to install pyzotero; the script only reads ZOTERO_CREDENTIALS and the CLI args, checks Zotero for duplicates, creates items/notes, and optionally downloads PDFs from arXiv. It does not read other environment variables or unrelated system files.

Install Mechanism

There is no automated install spec; the skill is instruction-only and asks the user to pip install pyzotero. No downloads from untrusted URLs or archive extraction are present in the package.

Credentials

Only ZOTERO_CREDENTIALS (userid:apiKey) is required and is the primary credential; this is appropriate for writing to a Zotero account. No unrelated secrets or config paths are requested.

Persistence & Privilege

always is false and the skill doesn't modify other skills or system configs. The skill can be invoked autonomously per platform default; this is normal but means it could write to your Zotero when invoked.

Assessment

This skill appears to do what it says: it uses the ZOTERO_CREDENTIALS you provide to add items (and optionally attach PDFs downloaded from arXiv) to your Zotero library. Before installing or using it: (1) treat your ZOTERO_CREDENTIALS like a secret — use a Zotero API key with the minimum needed scope (if possible) rather than a full master key; (2) review the script yourself (it is short and included) if you have any doubts; (3) be aware the agent can be invoked to run this skill and will then perform writes to your Zotero account; and (4) when supplying URLs ensure they are trustworthy (the script will download PDFs from the provided URL). If you want extra safety, create a limited-scope Zotero API key or run the script manually rather than allowing autonomous agent invocation.

Zotero Scholar

专业的文献入库助手。可以将论文元数据、PDF 链接以及 AI 生成的总结一键保存到你的 Zotero 库中。

使用说明

此 Skill 依赖本机安装的 Python（建议 Python 3.10 或更高版本），不再要求 brew 或 uv。

环境变量 ZOTERO_CREDENTIALS 的格式为：

userid:apiKey

例如在 Windows PowerShell 中：

$env:ZOTERO_CREDENTIALS="你的userid:你的apiKey"

例如在 Windows CMD 中：

set ZOTERO_CREDENTIALS=你的userid:你的apiKey

使用示例

python {baseDir}/scripts/save_paper.py \
  --title "Attention Is All You Need" \
  --authors "Vaswani et al." \
  --url "https://arxiv.org/abs/1706.03762"

依赖安装

请先在本机安装 Python 依赖：

pip install pyzotero

参数说明

参数	说明
--title	论文标题
--authors	作者列表（逗号分隔）
--url	论文链接（用于排重）
--abstract	论文摘要
--summary	AI 生成的简短总结或 Insight
--tags	标签列表（逗号分隔）