Security audit

literature-harvest-zotero

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed literature-to-Zotero workflow, but it includes operational anti-bot and proof-of-work bypass steps for automated document retrieval.

Install only if you are prepared to supervise every run, provide only scoped Zotero/NCBI credentials, verify that downloads are authorized by your institution and the source sites, and remove or disable the PMC proof-of-work and Scholar anti-blocking procedures. Prefer official APIs, open-access bulk mechanisms, and user-mediated downloads when automation is blocked.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill instructs use of environment variables, network access, browser automation, shell commands, and external APIs, yet no explicit permissions or constraints are declared. That increases the chance the skill will run with broader capabilities than users expect, especially because it also handles local files, downloads, and API credentials.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 72% confidence
Finding: The skill advertises a full literature-to-Zotero pipeline, but the documented behavior relies on ad hoc local scripts, manual browser interaction, and undeclared workspace dependencies. This mismatch can mislead operators about what the skill actually does and what controls are in place, creating risk of unsafe execution, broken auditability, and unintended data handling.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The skill contains operational instructions to harvest cookies for Google Scholar and solve PMC POW challenges to continue automated retrieval after anti-bot defenses intervene. These are not normal retrieval steps; they are explicit bypass techniques that enable access despite protective controls, which can violate terms of service and normalize abuse patterns.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The code is explicitly designed to detect a PMC proof-of-work challenge, solve it, and replay a forged access cookie to bypass the protection. That is an intentional anti-abuse circumvention mechanism unrelated to normal Zotero ingestion, and it enables automated evasion of service controls that are meant to throttle or deter scripted bulk downloading.

Ssd 4

High

Confidence: 94% confidence
Finding: The workflow is structured to systematically obtain documents across multiple sources while explicitly accommodating anti-bot obstacles, institutional-access quirks, and download workarounds. In context, this goes beyond benign citation management and creates a repeatable process for bypassing access controls at scale.

Ssd 2

High

Confidence: 96% confidence
Finding: The wording indirectly operationalizes bypass methods by framing them as retrieval fallbacks, but the substance is still anti-bot circumvention: direct POW challenge solving, retry logic, and no-proxy switching to defeat protection layers. Paraphrased language does not reduce the security significance of those instructions.

Ssd 4

Medium

Confidence: 93% confidence
Finding: The Scholar procedure teaches session priming, cookie acquisition, pacing, and fallback selection specifically to reduce blocking and maintain automated harvesting. That is a trust-building evasion pattern aimed at continuing collection despite anti-abuse controls, making the skill more dangerous than ordinary search automation.

Static analysis

No suspicious patterns detected.