skills/jeremylongshore/claude-code-plugins-plus/zai-cli/Socket

zai-cli

Warn

Audited by Socket on Apr 4, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS. The purpose is coherent, but the trust model is not: a personal, unpinned npm CLI is positioned between the user and official Z.AI services and receives the user's Z.AI API key. This is not confirmed malware, but it is a significant supply-chain and credential-forwarding risk, amplified by broad shell permissions.

Confidence: 88%Severity: 81%

Audit Metadata

Analyzed At

Apr 4, 2026, 12:43 PM

Package URL

pkg:socket/skills-sh/jeremylongshore%2Fclaude-code-plugins-plus%2Fzai-cli%2F@e53658556e79b7f73bad1d9f305e532816482d1d