Zotero Plugins Atlas
Plugins / Translation

Paper Workbench for Zotero

by TJR-USTC-HUB · github.com/TJR-USTC-HUB/paper-workbench-for-zotero

Turns the PDF reader into three columns: the paper, an automatic Chinese translation of your selection, and notes with an AI chat.

Paper Workbench for Zotero has Atlas grade B (use with care) because it downloads a program checked against a fixed fingerprint, and runs it, and 4 more findings. It works with Zotero 7–10. Last checked 6 Nov 2026.

TranslationAI & summariesReading & PDFs
View source
Downloads a .xpi file (1.2 MB). In Zotero, open Tools → Plugins and install it from the file.
In useAn estimate of how many copies of Zotero have it: Zotero downloads each new version once for every copy that has the plugin, so we count the downloads of its most-downloaded recent release. Rounded. Plugins that update from outside GitHub count low.
5
DownloadsAll-time downloads of its release files from GitHub, counting every update. Installs from elsewhere aren't counted.
5
ReleasesVersions published on GitHub. Everyone who has the plugin downloads each one again, which adds up in Downloads.
2
StarsPeople who starred the repository on GitHub: a rough measure of interest.
0
ContributorsPeople who have committed code to the repository.
2
LicenceThe licence the code is published under, as GitHub reports it.
AGPL-3.0
B
Atlas gradeUse with care
because it downloads a program checked against a fixed fingerprint, and runs it, and 4 more findings
Applies to v0.8.20.11, released 30 Oct 2026Code checked · not yet tested in a live Zotero
What we found in the codeSets the gradeThe worst finding in these three areas sets the grade.
Code transparencyReadable code; not yet checked against the published sourceThe developer uploaded the release file from the TJR-USTC-HUB account. We haven't yet checked whether this file matches the public source code.UnknownWe couldn't check this yet.
Updates
Updates come from this project's GitHub repositoryThe update address offers this version
Where your data goesOnly contacts services we could identify17 addresses in 5 groups.LowLow concern: normal for plugins that do this job. Listed so you know.
AI services (8)
api.anthropic.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.api.openai.comauth.openai.comchat.deepseek.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.chat.z.ainamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.chatglm.cnnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.chatgpt.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.www.kimi.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.
Scholarly services (4)
ar5iv.labs.arxiv.orgarxiv.orgdoi.orgnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.export.arxiv.org
Apps you connect (2)
dav.jianguoyun.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.mineru.netnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.
Code hosting (2)
github.comraw.githubusercontent.com
On your computer (1)
127.0.0.1
Where we found it
api.openai.comcontent/scripts/zotero-ai-sidebar.js · line 24659
baseURL: baseURL || `https://api.openai.com/v1`
auth.openai.comcontent/scripts/zotero-ai-sidebar.js · line 19499
this.tokenExchangeUrl = "https://auth.openai.com/oauth/token";
ar5iv.labs.arxiv.orgcontent/scripts/zotero-ai-sidebar.js · line 28947
var AR5IV_HTML_BASE = "https://ar5iv.labs.arxiv.org/html";
Powerful capabilitiesDownloads a program checked against a fixed fingerprint, and runs it, and 7 moreMediumMedium concern: worth reading before you install. One medium finding makes the grade B.
Medium concern (5)
Downloads a program checked against a fixed fingerprint, and runs itA zotero:// link (a web page can open one) can make it install add-ons without asking you (from zotero-plugin-toolkit)A zotero:// link can make it run code if you approve a prompt (from zotero-plugin-toolkit)Watches Zotero's network trafficLaunches programs on your computer
Low concern (2)
Works with files on your computerOther programs on this computer can change your library through it
Not a concern (1)
Lets programs on this computer connect through Zotero's built-in server
Where we found it
Downloads a program checked against a fixed fingerprint, and runs itcontent/scripts/zotero-ai-sidebar.js · line 7347

It checks the download against a fingerprint written into the plugin, so only a new version of the plugin can change what runs. We haven't yet reviewed what it is.

const response = await fetch(url, { signal: controller.signal });
A zotero:// link (a web page can open one) can make it install add-o…content/scripts/zotero-ai-sidebar.js · line 2186

zotero://plugin. zotero-plugin-toolkit removed this link in version 6.0.0; this plugin is built with an older version

Services.io.getProtocolHandler("zotero").wrappedJSObject._extensions["zotero://plugin"] = pluginBridgeExtension;
A zotero:// link can make it run code if you approve a promptcontent/scripts/zotero-ai-sidebar.js · line 2142

zotero://ztoolkit-debug

Services.io.getProtocolHandler("zotero").wrappedJSObject._extensions["zotero://ztoolkit-debug"] = debugBridgeExtension;
Watches Zotero's network trafficcontent/scripts/zotero-ai-sidebar.js · line 34735
service.registerChannelFilter(filter, 0);
Launches programs on your computercontent/scripts/zotero-ai-sidebar.js · line 233
const exec = Zotero?.Utilities?.Internal?.exec;
Before you installShown, not gradedFacts to help you decide. They don't change the grade.
Works withZotero 7, 8, 9, 10 · not 11 betaUpdates automatically
Zotero 7 ✓ worksZotero 8 ✓ worksZotero 9 ✓ worksZotero 10 ✓ worksZotero 11 beta ✗ doesn't work
What you'll needNothing extra detectedDetected automatically from its code
No further detail for this area yet.
MaintenanceActive · last release 30 Oct 20262 contributors
No further detail for this area yet.
LanguagesDocumentation in EnglishInterface: English and Chinese
No further detail for this area yet.
We report what we found in the code. Open any area for the evidence.How we gradeReport a problem

What it does

Written by AI from the README

Turns the PDF reader into three columns: the paper, an automatic Chinese translation of your selection, and notes with an AI chat. Chat answers only from the selected text. Needs an OpenAI-compatible Base URL and API key.

Reading and translating, noting and asking questions normally means juggling windows. This keeps them side by side. Selected text and your questions are sent to your chosen endpoint.

What you'll need

Detected automatically

We haven't detected any setup requirements. That isn't the same as none: check the developer's README.

Where your data goes

We found: only contacts services we could identify. 17 addresses in 5 groups.

AI services (8)
api.anthropic.comnamed in its codeapi.openai.comauth.openai.comchat.deepseek.comnamed in its codechat.z.ainamed in its codechatglm.cnnamed in its codechatgpt.comnamed in its codewww.kimi.comnamed in its code
Scholarly services (4)
ar5iv.labs.arxiv.orgarxiv.orgdoi.orgnamed in its codeexport.arxiv.org
Apps you connect (2)
dav.jianguoyun.comnamed in its codemineru.netnamed in its code
Code hosting (2)
github.comraw.githubusercontent.com
On your computer (1)
127.0.0.1
Evidence · file and line
api.openai.comcontent/scripts/zotero-ai-sidebar.js · line 24659
baseURL: baseURL || `https://api.openai.com/v1`
auth.openai.comcontent/scripts/zotero-ai-sidebar.js · line 19499
this.tokenExchangeUrl = "https://auth.openai.com/oauth/token";
ar5iv.labs.arxiv.orgcontent/scripts/zotero-ai-sidebar.js · line 28947
var AR5IV_HTML_BASE = "https://ar5iv.labs.arxiv.org/html";

Forks and copies

No forks listed.

The developer's response

The developer hasn't responded. Developers can reply here, and their reply sits next to our findings.I'm the developer

Ratings and reviews

What people who use it say. This is separate from the grade, which is what the code does, and never changes it.

No ratings yet.

Write a review
Your rating of Paper Workbench for Zotero v0.8.20.11

Your review is public, under the name you give, and published with the directory's data under CC BY 4.0. Links are removed. We never store your IP address: a scrambled code made from it is kept for 30 days to catch fake reviews. Every review is checked before it's published; how fake ones are spotted isn't published, so it can't be gamed.

Install Paper Workbench for Zotero
BUse with care
Before you install: It downloads a program checked against a fixed fingerprint, and runs it, and 4 more findings.Read the finding
Compare with similar plugins