Security audit

zotero-literature-review

Security checks for vulnerabilities and agentic risk

Overview

This Zotero literature-review skill is purpose-aligned and transparent about using local PDFs and optional online search, though users should scope sensitive research data carefully.

Install this only if you are comfortable letting the agent read the Zotero library, PDFs, tags, metadata, and generated temporary files you select. For confidential projects, limit the task to a specific collection or folder, choose local-only mode when external search is not needed, and delete extracted-text intermediates after review.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README states that the skill can read the local Zotero storage directory, parse folder structures, access PDFs, and extract metadata, but it does not prominently warn users that local files and document contents may be accessed. Because Zotero libraries often contain unpublished papers, annotations, and sensitive research materials, silent or poorly disclosed access creates a meaningful privacy and confidentiality risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation describes Zotero API use and web-search integrations for verifying and supplementing literature, but it does not clearly tell users that bibliography metadata, queries, collection names, tags, or other research context may be transmitted to external services. This is especially risky in an academic workflow, where search terms and library organization can reveal confidential projects, unpublished topics, or collaborator identities.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger phrases include very broad terms such as '文献综述' and 'literature review', which can match ordinary user requests and cause the skill to activate unexpectedly. In this skill, unintended activation is more dangerous because the documented behavior includes accessing local Zotero storage, PDFs, and external integrations, potentially leading to unnecessary data access or transmission without clear user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly promotes direct access to a local Zotero library and full PDF extraction, which can expose sensitive local documents, annotations, notes, file paths, and bibliographic metadata without first warning the user or obtaining explicit consent. In this context, the workflow is designed to process entire local libraries and full-text PDFs, so the absence of a privacy notice and scoped consent materially increases the risk of over-collection and unintended disclosure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: SQP-3 applies to all file types and covers language policy issues. The document's interaction templates, prompts, requirements, and output expectations are all prescribed in Chinese, but there is no indication that users may choose another language or locale, which can amount to forcing a specific language without opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill recommends online search and Zotero API usage but does not clearly disclose that user queries, keywords, bibliographic details, or possibly document-derived information may be sent to external services. Because the workflow encourages combined local-plus-network research, users may unknowingly cause sensitive research topics or citation data to be transmitted outside the local environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The example explicitly instructs scanning an entire local Zotero storage directory and then reading complete PDFs, but it provides no consent, minimization, or privacy warning. In an agent skill context, this can normalize broad access to a user's local academic library and document contents, potentially exposing unrelated sensitive files or copyrighted/private material beyond what is necessary for the task.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The README presents all operational guidance in Chinese, but does not state that the skill is Chinese-only or offer users a language/locale option. This can violate language-choice expectations because it implicitly forces a specific language without opt-in or justification.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.