Downloads a .xpi file (0.06 MB). In Zotero, open Tools → Plugins and install it from the file.
StarsPeople who starred the repository on GitHub: a rough measure of interest.
0
DownloadsAll-time downloads of its release files from GitHub. Installs from elsewhere aren't counted.
0
ContributorsPeople who have committed code to the repository.
1
LicenceThe licence the code is published under, as GitHub reports it.
None stated
B
Atlas gradeUse with care
A+ABBC
because any website you visit can make it act through its local server: it doesn't check where requests come from
Next rung: A, once every finding in the code comes out low.
Applies to v1.4.5, released 13 Aug 2026Code checked · tested installed in Zotero 10.0.3 on 27 Sep 2026
文
Documentation in Chinese onlyOur summary is in English, but the plugin's own docs and support are in Chinese.
What we found in the codeSets the gradeThe worst finding in these three areas sets the grade.
Code transparencyReadable code; not yet checked against the published sourceThe developer uploaded the release file from the Arc816 account. We haven't yet checked whether this file matches the public source code.UnknownWe couldn't check this yet.
Updates
Updates come from www.zoteroaihub.cnThe update address doesn't respond, so Zotero can't update it
Where your data goesOnly contacts services we could identify11 addresses in 2 groups.LowLow concern: normal for plugins that do this job. Listed so you know.
AI services (9)
aip.baidubce.comapi.anthropic.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.api.deepseek.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.api.moonshot.cnnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.api.openai.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.dashscope.aliyuncs.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.generativelanguage.googleapis.comopenrouter.ainamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.qianfan.bj.baidubce.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.
On your computer (2)
127.0.0.1named in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.localhostnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.
Where we found it
aip.baidubce.comaddon/content/scripts/aiHub.js · line 670
generativelanguage.googleapis.comaddon/content/scripts/aiHub.js · line 875
const base = this.config.baseURL.replace(/\/+$/, "") || "https://generativelanguage.googleapis.com/v1beta";
Powerful capabilitiesAny website you visit can make it act through its local server: it doesn't check where requests come from, and 3 moreMediumMedium concern: worth reading before you install. One medium finding makes the grade B.
Any website you visit can make it act through its local server: it doesn't check where requests come frommediumMedium concern: worth reading before you install.Uses the clipboardlowLow concern.Works with files on your computerlowLow concern.Uses Zotero's password managerlowLow concern.
Where we found it
Any website you visit can make it act through its local server: it d…addon/content/scripts/aiHub.js · line 2276
A website can make it change your library, only while its "write.enabled" setting is on (it's off by default); a setting can also open it to your network
name: "zotero_add_note",
Before you installShown, not gradedFacts to help you decide. They don't change the grade.
Works withZotero 7, 8, 9, 10 · not 11 betaManual updates only
Description coming soon. We haven't written a summary yet. The line above is the developer's own description; the developer's README is linked above.
What you'll need
Detected automatically
Or: a model on your own computerIt can use a local model such as Ollama
Where your data goes
We found: only contacts services we could identify. 11 addresses in 2 groups.
AI services (9)
aip.baidubce.comapi.anthropic.comnamed in its codeapi.deepseek.comnamed in its codeapi.moonshot.cnnamed in its codeapi.openai.comnamed in its codedashscope.aliyuncs.comnamed in its codegenerativelanguage.googleapis.comopenrouter.ainamed in its codeqianfan.bj.baidubce.comnamed in its code
On your computer (2)
127.0.0.1named in its codelocalhostnamed in its code
Evidence · file and line
aip.baidubce.comaddon/content/scripts/aiHub.js · line 670