Qiaomu Agent

What was checked

Plain notes from the hygiene checks.

• Permissions

  Pass

  No shell or command execution found, and no extra permission was declared.

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Concern

  can reach a host that is not written as a fixed address.

  NETWORK_NO_FIXED_HOST

  src/ui/conversation-image.ts, line 16

  if (file.url.startsWith("data:")) return (await fetch(file.url)).arrayBuffer();

  src/ui/conversation-image.ts, line 23

  const response = await fetch(file.url);

  DESIGN.md, line 111

  - Settings → 模型 is two cards: local agents (installed only; missing ones collapsed into one line) and providers (brand mark, name, host · model count, masked key with a status dot,

  Show more

  design-previews/2026-09-20-agent-chat-redesign/index.html, line 62

  async function send(payload){if(location.protocol==='file:'){await navigator.clipboard?.writeText(payload.label).catch(()=>{});return{ok:false}}const res=await fetch('/api/select',

  design-previews/2026-09-20-agent-sidebar/index.html, line 356

  try { const response = await fetch('/api/select',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify(payload)}); ok = response.ok; } catch {}

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV

  src/services/cli-backend.ts, line 83

  env: { ...(require("process") as { env: Record<string, string | undefined> }).env, ...this.detection.env },

  src/services/cli-discovery.ts, line 94

  const env = (require("process") as { env: Record<string, string | undefined> }).env;

  src/services/local-guard.ts, line 74

  rsa|ed25519|ecdsa)\b|\.git-credentials|\.netrc\b/i, "访问凭据或私人数据"],

  Show more

  src/services/cli-process.ts, line 18

  const environment = env ?? (require("process") as { env: Environment }).env;

  src/services/local-guard.ts, line 39

  const SECRET_FILE = /^(\.env(\.(?!example$|sample$|template$)[^/]+)?

  src/services/native-agent-backend.ts, line 308

  env: { ...(getRuntimeRequire()?.("process") as { env?: Record<string, string | undefined> } | undefined)?.env, ...this.detection.env },

  src/services/zcode-app-server.ts, line 104

  env: { ...(require("process") as { env: Record<string, string | undefined> }).env, ...this.detection.env },

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read.

  OBFUSCATION_FILE_OVER_READ_CAP

  src/prompts/library.json, line 1

  {

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 7aefa8b47f07. can reach a host that is not written as a fixed address. reads a credential or environment file. a file was over the read cap and was not fully read.

Date and source

Date checked: 23 Oct 2026

Read how this letter is chosen