registry / zcode-agent-kit / 0.2.4

zcode-agent-kit@0.2.4

Local ZCode provider kit: run GLM-5.3 / GLM-5.3-Flash from your own ZCode Desktop account inside your own agent harnesses (OMP, pi, Claude Code, Codex, OpenCode, Cline, Kilo Code, Aider, Continue, Goose).

AI Security Review

scanned 14d ago · by lpm-firewall-ai

Source inspection shows a non-mutating postinstall hint and user-invoked setup flows. The scanner's execution and network signals do not establish malicious behavior in these paths.

Static reason

One or more suspicious static signals were detected.

Trigger

Package installation prints a hint; configuration changes require a user to run setup or integration.

Impact

No confirmed attack surface was established from the inspected lifecycle and integration paths.

Mechanism

The postinstall branch logs setup instructions. The adapters configure local harnesses to use the local ZCode proxy.

AI rationale

Source inspection shows a non-mutating postinstall hint and user-invoked setup flows. The scanner's execution and network signals do not establish malicious behavior in these paths.

Decision evidence

public snapshot

AI called this Clean at 89.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The postinstall hook only prints a setup hint; it does not run setup automatically.
The compatibility setup shim delegates to the CLI only when explicitly invoked; postinstall selects the hint branch.
The proxy manager reports missing dependencies and directs the user to install them manually.
The CLI dispatches setup and integration through explicit commands.
The Aider adapter writes process-local configuration pointing to the local proxy.
The OMP adapter skips integration when its configuration file is absent.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 203 file(s), 1.86 MB of source, external domains: 10.0.0.5, 127.0.0.1, 169.254.169.254, 192.168.1.10, aider.chat, alicdn.com.attacker.test, anything.example, api.z.ai, attacker.test, auth.example, bigmodel.cn, billing.example, captcha.aliyuncs.com, captcha.ap-southeast-1.aliyuncs.com, cdn.example.com, chat.z.ai, code.claude.com, custom.example.com, developers.openai.com, docs.cline.bot, docs.continue.dev, evil-alicdn.com.attacker.net, evil.example, example.com, fixture.invalid, g.alicdn.com, github.com, goose-docs.ai, kilo.ai, notalicdn.com, o.alicdn.com, omp.sh, open.bigmodel.cn, opencode.ai, zcode.z.ai

Source & flagged code

12 flagged

package.jsonView file

•scripts.postinstall = node setup.mjs --postinstall-hint

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node setup.mjs --postinstall-hint

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

setup.mjsView file

11// duplicated setup logic). Legacy flags map as: --only=<list> → --harness=<list>. L12: import { spawnSync } from "node:child_process"; L13: import { join, dirname } from "node:path";

High

Child Process

Package source references child process execution.

setup.mjsView on unpkg · L11

proxy/zcode-proxy-manager.mjsView file

149L150: // Process start time — the PID-reuse guard. Windows asks PowerShell (ticks L151: // are locale-independent); POSIX reads /proc. null = not determinable here,

High

Shell

Package source references shell execution.

proxy/zcode-proxy-manager.mjsView on unpkg · L149

329if (!existsSync(join(PROXY_SRC, "node_modules"))) { L330: logLine("ERROR: proxy dependencies missing. Run: cd zcode-proxy-src && bun install --frozen-lockfile"); L331: return 4; ... L335: let spawnError = null; L336: const child = spawn("bun", ["run", "src/index.ts", "serve"], { L337: cwd: PROXY_SRC,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

proxy/zcode-proxy-manager.mjsView on unpkg · L329

zcode-proxy-src/src/proxy/captcha-happy.tsView file

395try { L396: new Function(body.toString("utf8")); L397: } catch (parseErr) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

zcode-proxy-src/src/proxy/captcha-happy.tsView on unpkg · L395

9* Mechanics: L10: * 1. cookie priming of https://zcode.z.ai/ (5-min cache) L11: * 2. CDN disk cache at ~/.zcode-captcha-cdn-cache/<sha1(url)> + in-mem cache ... L56: const res = await fetch(m.url, m.init); L57: const body = Buffer.from(await res.arrayBuffer()); L58: const headers = {}; ... L85: status: number; statusText: string; headers: Record<string, string>; L86: setCookie: string[]; body: Buffer; L87: } | { error: string } { ... L122: L123: const CDN_CACHE_DIR = path.join(os.homedir(), ".zcode-captcha-cdn-cache"); L124: const _memCdnCache = new Map();

Low

Weak Crypto

Package source references weak cryptographic algorithms.

zcode-proxy-src/src/proxy/captcha-happy.tsView on unpkg · L9

proxy/zcode-proxy-autostart.tsView file

21if (!gate) gate = (async () => { L22: const { pathToFileURL } = await import("node:url"); L23: const { createSessionPreflight } = await import(pathToFileURL(PREFLIGHT).href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

proxy/zcode-proxy-autostart.tsView on unpkg · L21

cli/zcode-kit.mjsView file

107function runProxyCli(args, opts = {}) { L108: const res = spawnSync("bun", ["run", "src/index.ts", ...args], { L109: cwd: ctx.proxySrc, L110: env: { ...process.env, ZCODE_PROXY_CONFIG: ctx.config }, L111: encoding: "utf8", ... L116: L117: function proxyFetch(path, init = {}, timeoutMs = 8000) { L118: const key = ctx.key();

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

cli/zcode-kit.mjsView on unpkg · L107

cli/adapters/aider.mjsView file

12protocol: "OpenAI-compatible via OPENAI_API_BASE + openai/<model> mapping", L13: primarySource: "https://aider.chat/docs/llms/openai-compat.html (checked 2026-09-13)", L14: detect: (home) => detectOnPath("aider") || detectOnPath("aider-chat"), ... L35: L36: import { execFileSync } from "node:child_process"; L37: function detectOnPath(cmd) { L38: try { L39: execFileSync(process.platform === "win32" ? "where" : "which", [cmd], { stdio: "pipe" }); L40: return true;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

cli/adapters/aider.mjsView on unpkg · L12

bin/zcode-aider.cmdView file

•path = bin/zcode-aider.cmd kind = build_helper sizeBytes = 648 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/zcode-aider.cmdView on unpkg

cli/adapters/omp.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

cli/adapters/omp.mjs#virtual:normalized:round1View on unpkg

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node setup.mjs --postinstall-hint

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node setup.mjs --postinstall-hint

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

setup.mjsView file

11// duplicated setup logic). Legacy flags map as: --only=<list> → --harness=<list>. L12: import { spawnSync } from "node:child_process"; L13: import { join, dirname } from "node:path";

High

Child Process

Package source references child process execution.

setup.mjsView on unpkg · L11

Findings

7 High6 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processsetup.mjs

HighShellproxy/zcode-proxy-manager.mjs

HighSame File Env Network Executioncli/zcode-kit.mjs

HighSandbox Evasion Gated Capabilitycli/adapters/aider.mjs

HighRuntime Package Installproxy/zcode-proxy-manager.mjs

HighSemantic Analysis Limitedcli/adapters/omp.mjs#virtual:normalized:round1

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requireproxy/zcode-proxy-autostart.ts

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperbin/zcode-aider.cmd

Affected versions and remediation

This report applies to zcode-agent-kit@0.2.4.

See all versions of zcode-agent-kit for other recorded verdicts.

Review the evidence and your use of zcode-agent-kit@0.2.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-09 06:27:02.656Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.