Downloads a .xpi file (0.1 MB). In Zotero, open Tools → Plugins and install it from the file.
StarsPeople who starred the repository on GitHub: a rough measure of interest.
2
DownloadsAll-time downloads of its release files from GitHub. Installs from elsewhere aren't counted.
3
ContributorsPeople who have committed code to the repository.
17
LicenceThe licence the code is published under, as GitHub reports it.
AGPL-3.0
B
Atlas gradeUse with care
A+ABBC
because updates are set to come from an address someone else could control, and 2 more findings
Next rung: A, once every finding in the code comes out low.
Applies to v1.0.0, released 23 May 2026Code checked · tested installed in Zotero 9.0.6 on 27 Sep 2026
Doesn't work with the current Zotero (10)Works with Zotero 7, 8, 9.
What we found in the codeSets the gradeThe worst finding in these three areas sets the grade.
Code transparencyUpdates are set to come from an address someone else could controlThe developer uploaded the release file from the Audanstu account. We haven't yet checked whether this file matches the public source code.MediumMedium concern: worth reading before you install. One medium finding makes the grade B.
Updates
Updates are set to come from local/my_vibero on GitHub, which doesn't exist or isn't public: if the owner of "local" published an update there, Zotero would install itThe update address is broken (nothing is there), so Zotero can't update it
Where your data goesOnly contacts services we could identify4 addresses in 2 groups.LowLow concern: normal for plugins that do this job. Listed so you know.
AI services (3)
api.deepseek.comseen when we ran itIt contacted this address when we ran it in Zotero.api.openai.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.ark.cn-beijing.volces.com
Apps you connect (1)
mineru.netnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.
Where we found it
api.deepseek.comcontent/scripts/magic_digest.js · line 117
deepseekBaseURL: "https://api.deepseek.com",
ark.cn-beijing.volces.comcontent/scripts/magic_digest.js · line 364
Powerful capabilitiesA zotero:// link (a web page can open one) can make it install add-ons without asking you, and 2 moreMediumMedium concern: worth reading before you install. One medium finding makes the grade B.
A zotero:// link (a web page can open one) can make it install add-ons without asking you (from zotero-plugin-toolkit)mediumMedium concern: worth reading before you install.A zotero:// link can make it run code if you approve a prompt (from zotero-plugin-toolkit)mediumMedium concern: worth reading before you install.Uses the clipboardlowLow concern.
Where we found it
A zotero:// link (a web page can open one) can make it install add-o…content/scripts/magic_digest.js · line 1691
Before you installShown, not gradedFacts to help you decide. They don't change the grade.
Works withZotero 7, 8, 9 · not 10, 11 betaDoesn't work with the current Zotero (10)MediumMedium concern: worth reading before you install. One medium finding makes the grade B.
Description coming soon. We haven't written a summary yet. The line above is the developer's own description; the developer's README is linked above.
What you'll need
Detected automatically
An API keyNeeds a key you get from the service (DeepSeek, Volcano Engine Ark and Alibaba DashScope (Qwen)). What needs it: An API key for at least one AI service (DeepSeek, Volcano Engine Ark or Qwen DashScope) to run the analysis.
Or: a model on your own computerIt can use a local model such as Ollama
Zotero 7, 8, 9Not working with Zotero 10
Where your data goes
We found: only contacts services we could identify. 4 addresses in 2 groups.
AI services (3)
api.deepseek.comseen when we ran itapi.openai.comnamed in its codeark.cn-beijing.volces.com
Apps you connect (1)
mineru.netnamed in its code
Evidence · file and line
api.deepseek.comcontent/scripts/magic_digest.js · line 117
deepseekBaseURL: "https://api.deepseek.com",
ark.cn-beijing.volces.comcontent/scripts/magic_digest.js · line 364