Fisfzy/zotero-harvest
C2Zotero 文献采集入库插件（DSH external plugin）：多源检索（OpenAlex/arXiv/Crossref/Europe PMC/Semantic Scholar）+ OA 下载链接解析（Unpaywall）+ 充分性审计 + 入库本地 Zotero + 触发 zotero-wave-rag 重建
★ 5+ · Fisfzy/zotero-harvest source on GitHub · this plugin in the registry
Fisfzy/zotero-harvest is a DeepSeek Harness plugin rated C2 — one powerful capability or sensitive behavior. It executes system commands, ships no manifest.
Not a plugin — depends on dsh packages but declares no plugin manifest
What it can do
| Capability | Flag | Evidence |
|---|---|---|
| executes system commands | exec | ×6 in authored code, e.g. src/types.ts:135, src/fetch/providers.ts:9 |
| ships no manifest | no_manifest | uses 1 services, 24 tool regs, no manifest |
Services it injects
tools
Outbound domains
api.crossref.org api.openalex.org export.arxiv.org arxiv.org api.semanticscholar.org www.ebi.ac.uk api.unpaywall.org scholar.google.com
Environment variables it reads
ZWR_DATA_DIR LIT_CONFIG_DIR LIT_ZWR_DIR
How to read this
Levels measure capability surface and transparency, not maliciousness. A C3 plugin can be entirely legitimate — a desktop shell genuinely needs subprocesses. The point is that you can see this before installing. See the levels explained and how dsh plugins work.
Findings come from static analysis of shipped code; nothing is executed. Think a flag is wrong? Open an issue — every flag cites the file and line it came from.