Will trying to flash an unofficial update with stock recovery harm my device?
Stock recovery should just fail, it will look for a digitally signed package from the manufacturer, not find it, and error out without making changes. If the developer who made the package specifically made it to work for that device and spoofed the signature somehow, it could do anything from work perfectly to perma-brick the device, hard to say.