OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Pass4 providerslatest audit Sep 15, 2026
Independent checks from skills.sh's audit partners.
The skill facilitates programmatic interaction with the Zotero reference management system via the pyzotero Python package. A potential indirect prompt injection surface exists because the skill ingests external bibliographic metadata and full-text PDF contents into the agent context while the agent possesses powerful tools such as Bash.
Detected behaviors
No alerts
No issues
Score: 93/100 · 2 sections analyzed