Zhikuncode AI Agent
by zhikunqingtaoCodex/Claude Code/Cursor的开源增强版，专注一句话实现复杂长程任务（教育、编程、办公、生活、娱乐、游戏）。部署在你自己的服务器上，团队用浏览器打开就能编程——包括手机。CLI & Web UI 双入口，Multi-Agent 协作，原生直连千问/DeepSeek 等国产大模型。技能/插件/跨会话记忆，8 层安全沙箱，数据不离开你的机器。Docker 一键部署，MIT 开源，零锁定。
Zhikuncode is an open-source ai agent by zhikunqingtao, written mainly in Java, with 534 GitHub stars and the MIT license. Its code was last updated Oct 31, 2026.
Scan summary: scanned Nov 5, 2026 at commit 5d00883. Seen able to run dynamic code. Scan policy
ScannedScanned. The automated checks below ran on the commit shown. Read each line for what was and was not covered.
Full scan at
5d00883 · Nov 5, 2026 ScannedStatic, secrets and dependency checks completed with no critical findings.
Warning. This check found something worth reading in the findings below. It is not proof of a problem.Static code scanwarnWarning. This check found something worth reading in the findings below. It is not proof of a problem.
Flagged. This check found an issue. See the findings below.Secrets scanfailFlagged. This check found an issue. See the findings below.
Flagged. This check found an issue. See the findings below.Dependency audit294 known vulnerabilitiesfailFlagged. This check found an issue. See the findings below.
Warning. This check found something worth reading in the findings below. It is not proof of a problem.ManifestnonewarnWarning. This check found something worth reading in the findings below. It is not proof of a problem.
Not applicable. This check does not apply to this kind of project, or it was not run in this scan.Buildn/aNot applicable. This check does not apply to this kind of project, or it was not run in this scan.
Not applicable. This check does not apply to this kind of project, or it was not run in this scan.Boot & handshaken/aNot applicable. This check does not apply to this kind of project, or it was not run in this scan.
Not applicable. This check does not apply to this kind of project, or it was not run in this scan.Network egressn/aNot applicable. This check does not apply to this kind of project, or it was not run in this scan.
Not applicable. This check does not apply to this kind of project, or it was not run in this scan.Reproducible (×3)n/aNot applicable. This check does not apply to this kind of project, or it was not run in this scan.
Findings (83)
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.Very long encoded string literal. Often used to hide a payload.
scripts/gold-audit-source-visuals.mjs:5 - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.body-parser@1.20.5: 2 known vulnerabilitiesGHSA-27r3-jxmh-p828, GHSA-v422-hmwv-36x6
backend/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.org.jsoup:jsoup@1.17.2: 2 known vulnerabilitiesGHSA-65r4-943x-97jj, GHSA-pmhh-3w7g-xqp8
backend/pom.xml - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.com.fasterxml.jackson.core:jackson-core@2.18.5: 4 known vulnerabilitiesGHSA-72hv-8253-57qq, GHSA-7hhh-6rmp-j9qf, GHSA-p6pp-m3f8-5c89, GHSA-r7wm-3cxj-wff9
backend/pom.xml - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.com.fasterxml.jackson.core:jackson-databind@2.18.5: 13 known vulnerabilitiesGHSA-3pjw-73gf-8qr5, GHSA-5gvw-p9qm-jgwh, GHSA-5jmj-h7xm-6q6v, GHSA-cxp5-3px4-pw24, GHSA-gx83-3vf8-gh7j +8 more
backend/pom.xml - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.io.micrometer:micrometer-core@1.14.14: 1 known vulnerabilityGHSA-g3pr-3p32-fp23
backend/pom.xml - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.org.apache.httpcomponents.core5:httpcore5@5.3.6: 1 known vulnerabilityGHSA-hf6x-8p5f-cgmf
backend/pom.xml - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.org.apache.httpcomponents.core5:httpcore5-h2@5.3.6: 1 known vulnerabilityGHSA-v3jc-474w-2wm6
backend/pom.xml - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.org.assertj:assertj-core@3.26.3: 1 known vulnerabilityGHSA-rqfh-9r24-8c9r
backend/pom.xml - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.org.springframework.boot:spring-boot@3.4.13: 1 known vulnerabilityGHSA-wwpq-f5c3-7hvx
backend/pom.xml - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.org.springframework.boot:spring-boot-starter-actuator@3.4.13: 2 known vulnerabilitiesGHSA-8hfc-fq58-r658, GHSA-mgvc-8q2h-5pgc
backend/pom.xml - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.org.springframework:spring-expression@6.2.15: 3 known vulnerabilitiesGHSA-9f52-rjqv-25qv, GHSA-r5w3-xv2f-j59q, GHSA-wxpp-56q6-5pcg
backend/pom.xml - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.brace-expansion@1.1.13: 6 known vulnerabilitiesGHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7 +1 more
frontend/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.brace-expansion@2.1.0: 6 known vulnerabilitiesGHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7 +1 more
frontend/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.brace-expansion@5.0.5: 7 known vulnerabilitiesGHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-jxxr-4gwj-5jf2, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr +2 more
frontend/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.browserslist@4.28.2: 4 known vulnerabilitiesGHSA-73wf-gq98-2v4g, GHSA-c83g-rgw3-j3cx, GHSA-73wf-gq98-2v4g, GHSA-c83g-rgw3-j3cx
frontend/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.dompurify@3.4.0: 13 known vulnerabilitiesGHSA-55q2-fjhq-7xh7, GHSA-6688-9rhm-gjv2, GHSA-76mc-f452-cxcm, GHSA-c2j3-45gr-mqc4, GHSA-c6gr-qvv4-5v3f +8 more
frontend/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.glob@10.4.5: 2 known vulnerabilitiesGHSA-3g3m-2fjr-6pw4, GHSA-5j98-mcp5-4vw2
frontend/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.js-yaml@4.1.1: 4 known vulnerabilitiesGHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68
frontend/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.nanoid@3.3.11: 3 known vulnerabilitiesGHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8, GHSA-xwg4-73v4-xw9w
frontend/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.postcss@8.5.8: 4 known vulnerabilitiesGHSA-6g55-p6wh-862q, GHSA-fxqj-rqcc-2cmp, GHSA-qx2v-qp2m-jg93, GHSA-r28c-9q8g-f849
frontend/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.source-map-js@1.2.1: 2 known vulnerabilitiesGHSA-68fv-2mgg-jv7q, GHSA-68fv-2mgg-jv7q
frontend/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.undici@7.24.7: 29 known vulnerabilitiesGHSA-2gqq-gqf2-x968, GHSA-2jfj-6hjv-fm6j, GHSA-2m5v-pch6-74hx, GHSA-35p6-xmwp-9g52, GHSA-3xpg-4rpp-hhhm +24 more
frontend/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.vite@5.4.21: 8 known vulnerabilitiesGHSA-4w7w-66w2-5vf9, GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-9jrq-w75r-8gcw, GHSA-fx2h-pf6j-xcff +3 more
frontend/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.mcp@1.12.4: 7 known vulnerabilitiesPYSEC-2026-1617, PYSEC-2026-3482, PYSEC-2026-3483, GHSA-5h93-6whr-6q8j, GHSA-84m7-p3x7-pcfv +2 more
python-service/requirements.txt - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.python-multipart@0.0.9: 8 known vulnerabilitiesPYSEC-2026-1851, PYSEC-2026-1852, PYSEC-2026-3036, PYSEC-2026-3037, PYSEC-2026-3038 +3 more
python-service/requirements.txt - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.starlette@0.41.3: 7 known vulnerabilitiesPYSEC-2026-161, PYSEC-2026-1941, PYSEC-2026-1942, PYSEC-2026-2280, PYSEC-2026-2281 +2 more
python-service/requirements.txt - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.brace-expansion@5.0.6: 6 known vulnerabilitiesGHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7 +1 more
workspace/app/frontend/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.nanoid@3.3.12: 2 known vulnerabilitiesGHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8
workspace/app/frontend/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.postcss@8.5.14: 2 known vulnerabilitiesGHSA-fxqj-rqcc-2cmp, GHSA-r28c-9q8g-f849
workspace/app/frontend/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.vite@8.0.11: 7 known vulnerabilitiesGHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-9jrq-w75r-8gcw, GHSA-fx2h-pf6j-xcff, GHSA-r825-w8mm-5pxw +2 more
workspace/app/frontend/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.zod@4.4.3: 1 known vulnerabilityGHSA-mrhx-c7xc-m3w5
workspace/app/frontend/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
docs/assets/e2e-tests/module04-06-agent-tool-permission-test.mjs:689 - lowLow. Minor, or common in normal tools. Shown for information.In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).
frontend/e2e/helpers/apos2-helpers.ts:289 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: jwt
backend/src/test/java/com/aicodeassistant/security/SensitiveDataFilterTest.java:118 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: generic-api-key
backend/src/test/java/com/aicodeassistant/security/SensitiveDataFilterTest.java:41 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: generic-api-key
backend/src/test/resources/fixtures/sensitive-test.env:6 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: generic-api-key4 matches in this file
docs/case-studies/assets/king/db/interaction-requests-20260809-0130-0701.json:14 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: generic-api-key17 matches in this file
docs/case-studies/zhikuncode-codex-gold-monitor-evidence.json:5445 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: generic-api-key2 matches in this file
docs/swe-bench/20260520/logs/django__django-12700/eval.sh:35 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: generic-api-key
docs/swe-bench/20260525/trajs/django__django-13551.md:442 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: generic-api-key2 matches in this file
docs/swe-bench/scripts/swe-bench-lite-full.jsonl:40 - lowLow. Minor, or common in normal tools. Shown for information.qs@6.14.2: 4 known vulnerabilitiesGHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-q8mj-m7cp-5q26, GHSA-x5fp-wj9c-mxmx
backend/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.qs@6.15.1: 4 known vulnerabilitiesGHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-q8mj-m7cp-5q26, GHSA-x5fp-wj9c-mxmx
backend/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.org.apache.commons:commons-lang3@3.17.0: 1 known vulnerabilityGHSA-j288-q9x7-2f5v
backend/pom.xml - lowLow. Minor, or common in normal tools. Shown for information.org.apache.httpcomponents.client5:httpclient5@5.4.4: 1 known vulnerabilityGHSA-hjcp-jmpx-g3qm
backend/pom.xml - lowLow. Minor, or common in normal tools. Shown for information.org.apache.logging.log4j:log4j-api@2.24.3: 1 known vulnerabilityGHSA-qv9r-c865-cp47
backend/pom.xml - lowLow. Minor, or common in normal tools. Shown for information.org.apache.logging.log4j:log4j-core@2.24.3: 5 known vulnerabilitiesGHSA-3pxv-7cmr-fjr4, GHSA-445c-vh5m-36rj, GHSA-6hg6-v5c8-fphq, GHSA-h383-gmxw-35v2, GHSA-vc5p-v9hr-52mj
backend/pom.xml - lowLow. Minor, or common in normal tools. Shown for information.org.springframework.boot:spring-boot-autoconfigure@3.4.13: 1 known vulnerabilityGHSA-ggg2-9786-hwc8
backend/pom.xml - lowLow. Minor, or common in normal tools. Shown for information.org.springframework.security:spring-security-core@6.4.13: 2 known vulnerabilitiesGHSA-vxf7-qj7q-83fh, GHSA-x2wq-9x2f-fhj7
backend/pom.xml - lowLow. Minor, or common in normal tools. Shown for information.org.springframework:spring-core@6.2.15: 1 known vulnerabilityGHSA-659m-px2c-25wj
backend/pom.xml - lowLow. Minor, or common in normal tools. Shown for information.org.springframework:spring-web@6.2.15: 1 known vulnerabilityGHSA-7m2p-62gw-p8qq
backend/pom.xml - lowLow. Minor, or common in normal tools. Shown for information.org.springframework:spring-websocket@6.2.15: 1 known vulnerabilityGHSA-q723-847q-5g8g
backend/pom.xml - lowLow. Minor, or common in normal tools. Shown for information.@babel/core@7.29.0: 2 known vulnerabilitiesGHSA-4x5r-pxfx-6jf8, GHSA-4x5r-pxfx-6jf8
frontend/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.@humanfs/node@0.16.7: 1 known vulnerabilityGHSA-p498-v437-472g
frontend/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.@remix-run/router@1.23.2: 1 known vulnerabilityGHSA-2j2x-hqr9-3h42
frontend/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.@vitest/mocker@2.1.9: 2 known vulnerabilitiesGHSA-82fw-gwwq-j7x9, GHSA-qxg6-89mg-rqv8
frontend/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.baseline-browser-mapping@2.10.15: 1 known vulnerabilityGHSA-w5vr-8v7q-w6rv
frontend/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.esbuild@0.21.5: 1 known vulnerabilityGHSA-67mh-4wv8-2f99
frontend/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.katex@0.16.45: 1 known vulnerabilityGHSA-238p-pmpm-9mq7
frontend/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.mermaid@11.14.0: 9 known vulnerabilitiesGHSA-2v8p-3f2j-5mp7, GHSA-3rrr-jr9j-h3q3, GHSA-6m6c-36f7-fhxh, GHSA-6x64-9x62-f2gx, GHSA-87f9-hvmw-gh4p +4 more
frontend/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.minimatch@10.2.5: 2 known vulnerabilitiesGHSA-g3hv-75wg-m249, GHSA-g3hv-75wg-m249
frontend/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.minimatch@9.0.9: 1 known vulnerabilityGHSA-g3hv-75wg-m249
frontend/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.postcss-selector-parser@6.0.10: 1 known vulnerabilityGHSA-rj75-hqrm-r3gf
frontend/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.postcss-selector-parser@6.1.2: 2 known vulnerabilitiesGHSA-rj75-hqrm-r3gf, GHSA-w9m9-85wc-3x92
frontend/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.prismjs@1.27.0: 1 known vulnerabilityGHSA-x7hr-w5r2-h6wg
frontend/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.react-router@6.30.3: 3 known vulnerabilitiesGHSA-2j2x-hqr9-3h42, GHSA-337j-9hxr-rhxg, GHSA-wrjc-x8rr-h8h6
frontend/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.react-router-dom@6.30.3: 1 known vulnerabilityGHSA-jjmj-jmhj-qwj2
frontend/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.pytest@8.3.4: 1 known vulnerabilityPYSEC-2026-1845
python-service/requirements.txt - lowLow. Minor, or common in normal tools. Shown for information.idna@3.9.0: 1 known vulnerabilityPYSEC-2026-215
python-service/requirements.txt - lowLow. Minor, or common in normal tools. Shown for information.baseline-browser-mapping@2.10.29: 1 known vulnerabilityGHSA-w5vr-8v7q-w6rv
workspace/app/frontend/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.No manifest declaring network access and environment variables (agent.json)
Automated result for the commit shown. See our scan policy. View the scan log
Maintainers can claim the listing to rescan, or dispute a result.
Zhikuncode alternatives
View more →Similar ai agents in Deployment & DevOps, ranked by GitHub stars. Compare licence, recent activity and scan status before you choose.
| Name | Stars | Licence | Last updated | Scan |
|---|---|---|---|---|
| Zhikuncode (this page) zhikunqingtao | 534 | MIT | Oct 31, 2026 | Scanned, no flagged issues |
| Langflow langflow-ai | 156k | MIT | Nov 1, 2026 | Scanned, no flagged issues |
| Novu novuhq | 40k | None found | Nov 1, 2026 | Not scanned yet |
| QwenPaw agentscope-ai | 37k | Apache-2.0 | Oct 30, 2026 | Scanned, no flagged issues |
| Kestra kestra-io | 30k | Apache-2.0 | Oct 30, 2026 | Scanned, no flagged issues |
| Chroma chroma-core | 30k | Apache-2.0 | Oct 30, 2026 | Scanned, no flagged issues |