zotero-sholar

将论文和摘要保存到 Zotero 文库。需配置 ZOTERO_CREDENTIALS 环境变量。

This skill appears coherent and implements its stated function. Before installing: (1) confirm you are comfortable providing ZOTERO_CREDENTIALS in the form userID:apiKey — that API key grants write access to the specified Zotero library, so limit the key's scope if possible; (2) the 'uv' runner will install the pyzotero package from the Python package index at runtime — ensure network installs are acceptable in your environment; (3) the script always treats the library as a personal ('user') library (no built-in group-library support); (4) the script will download PDFs from arXiv when URLs contain 'arxiv.org' and upload them to Zotero; review the code if you need stricter controls; (5) note the minor name/slug typo (zotero-sholar vs zotero-scholar) is cosmetic only. If you have any doubt, inspect the script yourself and consider creating a dedicated Zotero API key with minimal permissions and rotating it after testing.

Type: OpenClaw Skill Name: zotero-sholar Version: 0.0.1 The skill's purpose is to save papers and abstracts to Zotero. The `SKILL.md` provides clear instructions and does not contain any prompt injection attempts. The `scripts/save_paper.py` script uses the legitimate `pyzotero` library to interact with the Zotero API, authenticating via the `ZOTERO_CREDENTIALS` environment variable. It includes functionality to download and attach PDFs from arXiv, using `urllib.request` and `tempfile.TemporaryDirectory()` for safe handling. There is no evidence of data exfiltration, unauthorized command execution, persistence mechanisms, or other malicious intent. The code aligns with its stated purpose.