paper-harbor

SUSPICIOUS. The core workflow is coherent and largely privacy-preserving: official sites, manual login, metadata-only collection, and local Zotero import. The main concern is install/execution trust around the third-party EasyScholar browser extension and unspecified local helper scripts; that dependency is not as verifiable as Zotero and still operates inside a logged-in browser profile. No strong evidence of credential theft or offsite exfiltration is present, but the dependency trust and browser-session access keep the overall risk elevated.