The Agent Skills Directory

[CREDENTIALS_UNSAFE] (MEDIUM): The script scripts/get_zotero_pdf.py reads sensitive API keys (ZOTERO_API_KEY) and library IDs from Notes/.env. Accessing credential stores is a high-severity finding, but it is downgraded here because it is essential for the skill's primary function of Zotero integration.\n- [COMMAND_EXECUTION] (MEDIUM): The skill utilizes subprocess.run to execute curl for data retrieval and file downloads. Executing shell commands with variable inputs poses a risk, particularly when combined with external data sources.\n- [EXTERNAL_DOWNLOADS] (LOW): The skill downloads PDF content from api.zotero.org. While Zotero is a known service, downloading and executing logic on external files constitutes a security boundary cross.\n- [PROMPT_INJECTION] (LOW): The skill possesses an indirect prompt injection surface as it ingests untrusted PDF data from Zotero and converts it to markdown for agent processing.\n
Ingestion points: PDF files fetched from api.zotero.org or read from ~/Zotero/storage/ via scripts/get_zotero_pdf.py.\n
Boundary markers: Absent; converted markdown is read by the agent using Read() without explicit delimiters or instructions to ignore embedded commands.\n
Capability inventory: File system access (read/write), network requests via curl, and system command execution via subprocess.\n
Sanitization: Absent; the script uses the original_filename string from the Zotero API directly in the local file path /tmp/{original_filename} without sanitization, which could allow path traversal if the API returns a malicious filename.

zotero-paper-reader