Downloads a .xpi file (0.2 MB). In Zotero, open Tools → Plugins and install it from the file.
StarsPeople who starred the repository on GitHub: a rough measure of interest.
1
DownloadsAll-time downloads of its release files from GitHub. Installs from elsewhere aren't counted.
5
ContributorsPeople who have committed code to the repository.
1
LicenceThe licence the code is published under, as GitHub reports it.
AGPL-3.0
C
Atlas gradeNot recommended
A+ABCC
because it installs and runs npm or PyPI packages without a fixed version
Next rung: B, once nothing in the code is a serious concern.
Applies to v0.1.8, released 14 Sep 2026Code checked · tested installed in Zotero 10.0.3 on 27 Sep 2026
文
Documentation in Chinese onlyOur summary is in English, but the plugin's own docs and support are in Chinese.
What we found in the codeSets the gradeThe worst finding in these three areas sets the grade.
Code transparencyReadable code, uploaded by the project's automated GitHub buildThe release file was uploaded by the project's automated GitHub build. We haven't yet rebuilt it from the source to compare.LowLow concern: normal for plugins that do this job. Listed so you know.
Updates
Updates come from this project's GitHub repositoryThe update address offers this version
Where your data goesOnly contacts services we could identify11 addresses in 4 groups.LowLow concern: normal for plugins that do this job. Listed so you know.
fanyi-api.baidu.compdf2zh-next (SiliconFlow, or the engine it's set up with)translate.googleapis.com
Scholarly services (1)
api.crossref.orgseen when we ran itIt contacted this address when we ran it in Zotero.
On your computer (2)
127.0.0.1named in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.localhost
Where we found it
api.anthropic.comcontent/scripts/zotwanglele.js · line 4145
baseUrl: "https://api.anthropic.com",
api.deepseek.comcontent/scripts/zotwanglele.js · line 4131
baseUrl: "https://api.deepseek.com",
api.openai.comcontent/scripts/zotwanglele.js · line 4138
baseUrl: "https://api.openai.com",
Powerful capabilitiesInstalls and runs npm or PyPI packages without a fixed version, and 5 moreHighHigh concern: a serious problem. One high finding makes the grade C.
Installs and runs npm or PyPI packages without a fixed versionhighHigh concern: a serious problem.A zotero:// link (a web page can open one) can make it install add-ons without asking you (from zotero-plugin-toolkit)mediumMedium concern: worth reading before you install.A zotero:// link can make it run code if you approve a prompt (from zotero-plugin-toolkit)mediumMedium concern: worth reading before you install.Launches programs on your computermediumMedium concern: worth reading before you install.Stores API keys or passwordslowLow concern.Works with files on your computerlowLow concern.
Where we found it
Installs and runs npm or PyPI packages without a fixed versioncontent/scripts/zotwanglele.js · line 8743
Installs packages without a fixed version
const runArgs = ["run", "--python", "3.12"];
A zotero:// link (a web page can open one) can make it install add-o…content/scripts/zotwanglele.js · line 129