pyzotero
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes bibliographic items, collections, tags, notes, and full-text document contents which can originate from shared or untrusted external sources.
- Ingestion points: Content is loaded into the agent context through methods such as
zot.items()inreferences/read-api.mdandzot.fulltext_item()inreferences/full-text.md. - Boundary markers: There are no specific boundary delimiters or isolation instructions defined to instruct the model to ignore potential malicious prompts embedded within reference titles, abstracts, or PDF text contents.
- Capability inventory: According to
SKILL.md, the agent is granted access to high-privilege capabilities including theBashtool. - Sanitization: The reference patterns do not implement text sanitization or filtering logic before rendering or processing retrieved metadata.
Audit Metadata