looking forward to having a plugin directory or listing again

kate.nyhan · 2026-09-16T21:22:24+00:00

Hi folks, I see that a plugin directory is planned, according to https://www.zotero.org/support/plugins. It would be really helpful to know which plugins work with the current version of Zotero and which don't. And amazing if I could sign up for a notification when a given plugin is updated.

adamsmith · 2026-09-16T21:42:17+00:00

The 3rd party marketplace is pretty comprehensive & well structured: https://zotero-chinese.com/en/plugins/

kate.nyhan · 2026-09-16T22:23:57+00:00

This is great! Thanks for pointing me towards it.
Can I ask -- what is the business model of Zotero-Chinese.com? I tend to be pretty conservative about installing browser plugins that need broad permissions (as the Zotero browser plugin does). At a technical level, I have no idea whether Zotero application plugins could leverage the Zotero browser plugin for malicious purposes.... Maybe I am worried about an impossibility?
It's one thing if I'm getting Zotero plugins directly from known organizations like PubPeer or Scite. With a 3rd party marketplace, I'm not really sure how to evaluate the plugins offered there. How can I reassure myself that a given plugin is kosher?

adamsmith · 2026-09-17T01:18:48+00:00

The marketplace isn't what you should worry about -- it's a static site that's built on top of a public github repository and I don't think it needs a business model: it's one of the way the group of Chinese Zotero users/developers want to promote the platform, just like there is a French Zotero site.
The plugins listed are all hosted on github, so they have individual repositories and they're maintained by individuals -- most plugins you're familiar with are listed there.

Just like with plugins listed on Zotero's plugin page, there's no certain way to tell if you can trust them. A developer who is known in the community is a signal (like with BetterBibTeX), affiliation with an academic institution (Zotero OCR/Uni Mannheim) another one, but for lots of plugins there is no clear signal. You can use stars as indicators of popularity, which gives you some sense, but obviously people can make a popular plugin and abuse it. You can use an LLM to evaluate the source code within the downloaded .xpi file (or do it yourself, but I assume that's tricky) and any decent LLM would be able to spot obvious major concerns and/or malware, but since plugins update automatically, that's not perfect protection, either.

Going by both experience and realistic threat scenarios, I'd worry much more about the plugin being poorly coded and breaking something in Zotero, worst case corrupting data (one of the AI plugins has caused some significant issues lately, e.g.). Here you can look at past reports as one indicator (understanding that more popular plugins will have many more reported issues). Making sure the plugin is actively maintained (look at github issues & response) is also a good idea.

As for abuse, it would be quite tricky for a Zotero plugin to access information beyond your Zotero library and attachments, but it'd be very easy for any plugin to access those and send the information to a server-- to calibrate risk perception: I don't believe there as ever been a documented case of that happening in close to 20 years of Zotero plugins.

dstillman · 2026-09-17T02:09:32+00:00

One correction:

As for abuse, it would be quite tricky for a Zotero plugin to access information beyond your Zotero library and attachments

Current Zotero plugins are not restricted to your Zotero library and attachments — they can read anything in your OS user account that the OS itself doesn't block. It's true that we're not aware of this happening, but there's currently nothing outside of OS-based access controls stopping a malicious plugin from stealing passwords, reading documents on your disk, mining crypto, etc. We're hoping to provide a framework for sandboxed plugins that don't have such capabilities in the near future.