Zotero Enhanced

Manages the Zotero library. Supports adding new PDF documents with automatic metadata fetching (Crossref/arXiv), searching for existing items, reading attach...

This package appears to do what it says: manage Zotero items, fetch metadata from Crossref/arXiv, and optionally use WebDAV. Before installing, consider: (1) Only provide ZOTERO_API_KEY and ZOTERO_USER_ID from a trusted Zotero account; the skill will use them to create/read/update items. (2) If you use WebDAV, only point WEBDAV_URL to servers you control/trust — files are uploaded/downloaded to that endpoint. (3) The scripts write temporary files to /tmp and (if you request backups) create files under $HOME/.zotero-backup — review and secure/clean those as needed. (4) Minor inconsistencies: some scripts reference xmllint/stat behavior that isn't listed in the required binaries, and SECURITY.md claims 'set -euo pipefail' though many scripts set -e and pipefail but not -u; these are implementation hygiene issues rather than indicators of malice. If you need higher assurance, request a signed release or a maintainer contact and review the full untruncated scripts (xmllint/other optional dependencies) before use.

Type: OpenClaw Skill Name: zotero-enhanced Version: 1.3.5 The zotero-enhanced skill bundle is a legitimate toolset for managing Zotero libraries, supporting metadata extraction from academic APIs (Crossref, arXiv) and file synchronization via Zotero's cloud or WebDAV. The scripts (e.g., add_to_zotero_universal.sh, read_universal.sh, and note management utilities) are transparently written in Bash, utilizing standard tools like curl, jq, and pdftotext without any evidence of obfuscation, credential exfiltration to unauthorized third parties, or malicious execution patterns. The bundle includes a detailed SECURITY.md and implements safety features such as dry-run modes, input sanitization via jq, and local backups for deleted items.