registry / zcode-agent-kit / 0.2.3

zcode-agent-kit@0.2.3

Local ZCode provider kit: run GLM-5.3 / GLM-5.3-Flash from your own ZCode Desktop account inside your own agent harnesses (OMP, pi, Claude Code, Codex, OpenCode, Cline, Kilo Code, Aider, Continue, Goose).

AI Security Review

scanned 14d ago · by lpm-firewall-ai

The install lifecycle hook only prints a hint, while explicit setup can register a first-party OMP startup extension. This warrants a warning for extension lifecycle risk; the inspected source does not establish an attack.

Static reason

One or more suspicious static signals were detected.

Trigger

The user runs zcode-kit setup and the OMP configuration is present.

Impact

The integration adds package code to the OMP agent’s startup lifecycle; inspected excerpts show no credential exfiltration or unrelated control-surface mutation.

Mechanism

The OMP adapter writes a package-owned extension that checks local proxy health and can start the proxy during an agent session.

AI rationale

Evidence

cli/adapters/omp.mjsproxy/zcode-proxy-autostart.ts~/.omp/agent/extensions/zcode-proxy-autostart.ts~/.omp/agent/models.yml~/.omp/agent/config.yml

Network endpoints1

127.0.0.1

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The postinstall hook runs a hint mode that asks the user to run setup.
The CLI runs setup only when the user selects the setup command.
The OMP adapter writes this package’s startup extension into the user’s OMP agent directory when setup is run and an OMP models file exists.
The extension checks the local proxy and can start it during an agent session.

Evidence against

The postinstall hook only prints a setup hint; it does not itself configure agent files.
The OMP adapter skips integration when the expected user configuration file is absent.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 202 file(s), 1.86 MB of source, external domains: 127.0.0.1, aider.chat, anything.example, api.z.ai, auth.example, bigmodel.cn, billing.example, captcha.ap-southeast-1.aliyuncs.com, cdn.example.com, chat.z.ai, code.claude.com, custom.example.com, developers.openai.com, docs.cline.bot, docs.continue.dev, evil-alicdn.com.attacker.net, evil.example, example.com, fixture.invalid, g.alicdn.com, github.com, goose-docs.ai, kilo.ai, o.alicdn.com, omp.sh, open.bigmodel.cn, opencode.ai, zcode.z.ai

Source & flagged code

12 flagged

package.jsonView file

•scripts.postinstall = node setup.mjs --postinstall-hint

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node setup.mjs --postinstall-hint

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

setup.mjsView file

11// duplicated setup logic). Legacy flags map as: --only=<list> → --harness=<list>. L12: import { spawnSync } from "node:child_process"; L13: import { join, dirname } from "node:path";

High

Child Process

Package source references child process execution.

setup.mjsView on unpkg · L11

proxy/zcode-proxy-manager.mjsView file

149L150: // Process start time — the PID-reuse guard. Windows asks PowerShell (ticks L151: // are locale-independent); POSIX reads /proc. null = not determinable here,

High

Shell

Package source references shell execution.

proxy/zcode-proxy-manager.mjsView on unpkg · L149

329if (!existsSync(join(PROXY_SRC, "node_modules"))) { L330: logLine("ERROR: proxy dependencies missing. Run: cd zcode-proxy-src && bun install --frozen-lockfile"); L331: return 4; ... L335: let spawnError = null; L336: const child = spawn("bun", ["run", "src/index.ts", "serve"], { L337: cwd: PROXY_SRC,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

proxy/zcode-proxy-manager.mjsView on unpkg · L329

zcode-proxy-src/src/proxy/captcha-happy.tsView file

347try { L348: new Function(body.toString("utf8")); L349: } catch (parseErr) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

zcode-proxy-src/src/proxy/captcha-happy.tsView on unpkg · L347

9* Mechanics: L10: * 1. cookie priming of https://zcode.z.ai/ (5-min cache) L11: * 2. CDN disk cache at ~/.zcode-captcha-cdn-cache/<sha1(url)> + in-mem cache ... L56: const res = await fetch(m.url, m.init); L57: const body = Buffer.from(await res.arrayBuffer()); L58: const headers = {}; ... L85: status: number; statusText: string; headers: Record<string, string>; L86: setCookie: string[]; body: Buffer; L87: } | { error: string } { ... L122: L123: const CDN_CACHE_DIR = path.join(os.homedir(), ".zcode-captcha-cdn-cache"); L124: const _memCdnCache = new Map();

Low

Weak Crypto

Package source references weak cryptographic algorithms.

zcode-proxy-src/src/proxy/captcha-happy.tsView on unpkg · L9

proxy/zcode-proxy-autostart.tsView file

21if (!gate) gate = (async () => { L22: const { pathToFileURL } = await import("node:url"); L23: const { createSessionPreflight } = await import(pathToFileURL(PREFLIGHT).href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

proxy/zcode-proxy-autostart.tsView on unpkg · L21

cli/zcode-kit.mjsView file

107function runProxyCli(args, opts = {}) { L108: const res = spawnSync("bun", ["run", "src/index.ts", ...args], { L109: cwd: ctx.proxySrc, L110: env: { ...process.env, ZCODE_PROXY_CONFIG: ctx.config }, L111: encoding: "utf8", ... L116: L117: function proxyFetch(path, init = {}, timeoutMs = 8000) { L118: const key = ctx.key();

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

cli/zcode-kit.mjsView on unpkg · L107

cli/adapters/aider.mjsView file

12protocol: "OpenAI-compatible via OPENAI_API_BASE + openai/<model> mapping", L13: primarySource: "https://aider.chat/docs/llms/openai-compat.html (checked 2026-09-13)", L14: detect: (home) => detectOnPath("aider") || detectOnPath("aider-chat"), ... L35: L36: import { execFileSync } from "node:child_process"; L37: function detectOnPath(cmd) { L38: try { L39: execFileSync(process.platform === "win32" ? "where" : "which", [cmd], { stdio: "pipe" }); L40: return true;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

cli/adapters/aider.mjsView on unpkg · L12

bin/zcode-aider.cmdView file

•path = bin/zcode-aider.cmd kind = build_helper sizeBytes = 648 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/zcode-aider.cmdView on unpkg

cli/adapters/omp.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

cli/adapters/omp.mjs#virtual:normalized:round1View on unpkg

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node setup.mjs --postinstall-hint

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node setup.mjs --postinstall-hint

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

setup.mjsView file

11// duplicated setup logic). Legacy flags map as: --only=<list> → --harness=<list>. L12: import { spawnSync } from "node:child_process"; L13: import { join, dirname } from "node:path";

High

Child Process

Package source references child process execution.

setup.mjsView on unpkg · L11

Findings

7 High6 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processsetup.mjs

HighShellproxy/zcode-proxy-manager.mjs

HighSame File Env Network Executioncli/zcode-kit.mjs

HighSandbox Evasion Gated Capabilitycli/adapters/aider.mjs

HighRuntime Package Installproxy/zcode-proxy-manager.mjs

HighSemantic Analysis Limitedcli/adapters/omp.mjs#virtual:normalized:round1

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requireproxy/zcode-proxy-autostart.ts

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperbin/zcode-aider.cmd

Affected versions and remediation

This report applies to zcode-agent-kit@0.2.3.

See all versions of zcode-agent-kit for other recorded verdicts.

Review the evidence and your use of zcode-agent-kit@0.2.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-09 06:27:03.225Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.