A zotero:// link (a web page can open one) can make it install add-ons without asking youcontent/folder-import.js · line 1163Services.io.getProtocolHandler("zotero").wrappedJSObject._extensions["zotero://plugin"] = pluginBridgeExtension;Reply
A zotero:// link can make it run code if you approve a promptcontent/folder-import.js · line 1105Services.io.getProtocolHandler("zotero").wrappedJSObject._extensions["zotero://ztoolkit-debug"] = debugBridgeExtension;Reply
Launches programs on your computercontent/folder-import.js · line 7521const proc = Components.classes["@mozilla.org/process/util;1"].createInstance(Components.interfaces.nsIProcess);Reply
Sends data through a public relay: 0x0.stcontent/folder-import.js · line 6582const response = await fetch("https://0x0.st", {Reply
✓Readable code, uploaded by the project's automated GitHub build
Then A+
Pass the live test in Zotero 10We install it in a fresh Zotero and record what it does. Every plugin at A is tested.
README badge[](https://zoteroplugins.org/p/zotero-folder-import--yunoinsky)Updates itself when the grade changes.
Disagree with a finding?Respond on GitHub from an account that maintains the repository. Your response is published next to the card, with our reply.Respond to the card