@zaip-ai/cli@1.0.7
CLI oficial para instalar e configurar o ZAIP-AIOS em qualquer repositório
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is an explicit-user-command agent configuration installer with broad declared capabilities, so it warrants a warning. The inspected source does not establish malicious behavior or a publish-block chain.
Static reason
No blocking static signals were detected.
Trigger
User runs `zaip init` or invokes `initializeZaip`; installed hooks later run on Codex subagent events.
Impact
Can expand the configured agent's filesystem/tool capabilities and execute telemetry hooks in that project.
Mechanism
Writes agent-control configuration and Node lifecycle hooks into the selected project.
AI rationale
This is an explicit-user-command agent configuration installer with broad declared capabilities, so it warrants a warning. The inspected source does not establish malicious behavior or a publish-block chain.
Evidence
dist/services/install-agents-template.jsdist/services/adapters.jsdist/services/codex-config-template.jsdist/services/codex-subagent-hook-template.jsdist/services/global-codex-config.jstemplates/.agents/design/packages/windows-launcher/Program.cs.codex/config.toml.codex/hooks/zaip-pre-tool-use.mjs.codex/hooks/zaip-subagent-lifecycle.mjs.agents/local/hooks/subagent-lifecycle.ndjson
Network endpoints1
developers.openai.com/mcp
Decision evidence
public snapshotAI called this Suspicious at 92.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- Explicit `zaip init` installs `.codex/config.toml` and lifecycle hooks.
- Generated Codex profile grants `~/.ssh` write, enables computer-use/open-world tools, and defines full-access permissions.
- Subagent hook persists diagnostics and spawns the bundled runtime on later agent events.
Evidence against
- No npm preinstall/install/postinstall lifecycle hook.
- No credential harvesting, HTTP upload, or remote payload download found in inspected CLI services.
- Global `~/.codex/config.toml` handling only removes legacy `zaip-agent-*` registrations.
- Template paths and hashes are validated; writes reject path traversal and symlinks.
- Windows executables are manifest-hashed launchers matching shipped C# source.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedtemplates/.agents/design/zaip-design.exeView file
•path = templates/.agents/design/zaip-design.exe
kind = payload_in_excluded_dir
sizeBytes = 7680
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
templates/.agents/design/zaip-design.exeView on unpkg•path = templates/.agents/design/zaip-design.exe
kind = native_binary
sizeBytes = 7680
magicHex = [redacted]
Medium
Ships Native Binary
Package ships native binary artifacts.
templates/.agents/design/zaip-design.exeView on unpkgtemplates/.agents/design/packages/windows-launcher/build-design-launcher.ps1View file
•path = templates/.agents/design/packages/windows-launcher/build-design-launcher.ps1
kind = build_helper
sizeBytes = 3452
magicHex = [redacted]
Findings
2 High6 Medium5 Low
HighShips High Entropy Blobtemplates/.agents/design/apps/catalog/dist/storybook/nunito-sans-bold-italic.woff2
HighPayload In Excluded Dirtemplates/.agents/design/zaip-design.exe
MediumEnvironment Vars
MediumShips Native Binarytemplates/.agents/design/zaip-design.exe
MediumShips Build Helpertemplates/.agents/design/packages/windows-launcher/build-design-launcher.ps1
MediumOversized Source Filetemplates/.agents/runtime/bin/zaip.mjs
MediumOversized Cli Entrypointtemplates/.agents/runtime/bin/zaip.mjs
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Low
Affected versions and remediation
This report applies to @zaip-ai/cli@1.0.7.
See all versions of @zaip-ai/cli for other recorded verdicts.
- Review the evidence and your use of @zaip-ai/cli@1.0.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.