{"id":"kilo.ai/kilo","name":"Kilo Code CLI","commands":["kilo","kilocode"],"examples":[{"run":"kilo","does":"Start the interactive terminal UI in the current directory"},{"run":"kilo auth","does":"Manage provider credentials"},{"run":"kilo run \"<task>\"","does":"Run a task with a message without opening the TUI"},{"run":"kilo --continue","does":"Resume the most recent session in this workspace"}],"description":"Terminal version of the open source Kilo Code agentic engineering platform.","homepage":"https://kilo.ai","repository":"https://github.com/Kilo-Org/kilocode","license":"MIT","agentic":true,"latest_version":"7.8.18","vendor":"Kilo Code","install":"curl -fsSL https://kilo.ai/cli/install | bash","publisher":"third-party","w3bs":"w3bs install kilo.ai/kilo","scan":{"status":"passed","scanner":"threatcrush 0.13.30","filesScanned":8515,"summary":{"critical":0,"high":24,"medium":56,"low":161,"info":0},"malware":0,"truncated":true,"version":"7.8.18","sources":{"installer":"https://kilo.ai/cli/install","installerSha256":"a9f615d2dfd86555864cd4c04ebda6dd7e2f6f600a5abfc5d8baae666be07b07","repository":"github.com/Kilo-Org/kilocode","commit":"2df562cb336d1987ee40da07359ff84a4a216f66"},"notes":[],"scannedAt":"2026-11-02T22:59:28.703Z","findings":[{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"high","category":"secret","cwe":"CWE-798","file":"source/.github/docs-sync/selftest.mjs","line":712,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"high","category":"secret","cwe":"CWE-798","file":"source/.github/docs-sync/selftest.mjs","line":713,"malware":false},{"ruleId":"js-ssrf-outbound-request","title":"outbound request to a non-constant URL","severity":"high","category":"code","cwe":"CWE-918","file":"source/packages/core/src/oauth/page.ts","line":127,"malware":false},{"ruleId":"secret-generic-api-key","title":"Generic API Key","severity":"high","category":"secret","cwe":"CWE-798","file":"source/packages/kilo-docs/pages/ai-providers/cloudflare.md","line":48,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"high","category":"secret","cwe":"CWE-798","file":"source/packages/kilo-e2e/src/scenarios.ts","line":68,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"high","category":"secret","cwe":"CWE-798","file":"source/packages/kilo-e2e/src/scenarios.ts","line":77,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"high","category":"secret","cwe":"CWE-798","file":"source/packages/kilo-e2e/src/scenarios.ts","line":86,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"high","category":"secret","cwe":"CWE-798","file":"source/packages/kilo-gateway/src/edit-prompt.ts","line":22,"malware":false},{"ruleId":"secret-generic-api-key","title":"Generic API Key","severity":"high","category":"secret","cwe":"CWE-798","file":"source/packages/kilo-telemetry/src/client.ts","line":8,"malware":false},{"ruleId":"tls-verification-disabled","title":"TLS certificate verification disabled","severity":"high","category":"code","cwe":"CWE-295","file":"source/packages/kilo-vscode/src/services/cli-backend/server-manager.ts","line":134,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"high","category":"secret","cwe":"CWE-798","file":"source/packages/kilo-vscode/webview-ui/src/components/settings/mcp-oauth-config.ts","line":77,"malware":false},{"ruleId":"manifest-typosquat","title":"dependency name close to a popular package","severity":"high","category":"manifest","cwe":"CWE-1357","file":"source/packages/opencode/package.json","line":182,"malware":false},{"ruleId":"js-ssrf-outbound-request","title":"outbound request to a non-constant URL","severity":"high","category":"code","cwe":"CWE-918","file":"source/packages/opencode/src/plugin/digitalocean.ts","line":93,"malware":false},{"ruleId":"js-nosql-injection","title":"NoSQL query built from request data","severity":"high","category":"code","cwe":"CWE-943","file":"source/packages/opencode/src/server/routes/instance/httpapi/handlers/pty.ts","line":120,"malware":false},{"ruleId":"js-nosql-injection","title":"NoSQL query built from request data","severity":"high","category":"code","cwe":"CWE-943","file":"source/packages/opencode/src/server/routes/instance/httpapi/handlers/pty.ts","line":138,"malware":false},{"ruleId":"js-header-injection","title":"response header set from request input","severity":"high","category":"code","cwe":"CWE-113","file":"source/packages/opencode/src/server/routes/instance/httpapi/handlers/session.ts","line":162,"malware":false},{"ruleId":"js-nosql-injection","title":"NoSQL query built from request data","severity":"high","category":"code","cwe":"CWE-943","file":"source/packages/opencode/src/server/routes/instance/httpapi/handlers/session.ts","line":205,"malware":false},{"ruleId":"js-nosql-injection","title":"NoSQL query built from request data","severity":"high","category":"code","cwe":"CWE-943","file":"source/packages/opencode/src/server/routes/instance/httpapi/handlers/workspace.ts","line":61,"malware":false},{"ruleId":"js-nosql-injection","title":"NoSQL query built from request data","severity":"high","category":"code","cwe":"CWE-943","file":"source/packages/server/src/handlers/credential.ts","line":11,"malware":false},{"ruleId":"js-nosql-injection","title":"NoSQL query built from request data","severity":"high","category":"code","cwe":"CWE-943","file":"source/packages/server/src/handlers/credential.ts","line":18,"malware":false},{"ruleId":"js-nosql-injection","title":"NoSQL query built from request data","severity":"high","category":"code","cwe":"CWE-943","file":"source/packages/server/src/handlers/fs.ts","line":35,"malware":false},{"ruleId":"js-nosql-injection","title":"NoSQL query built from request data","severity":"high","category":"code","cwe":"CWE-943","file":"source/packages/server/src/handlers/permission.ts","line":93,"malware":false},{"ruleId":"js-nosql-injection","title":"NoSQL query built from request data","severity":"high","category":"code","cwe":"CWE-943","file":"source/packages/server/src/handlers/pty.ts","line":82,"malware":false},{"ruleId":"js-nosql-injection","title":"NoSQL query built from request data","severity":"high","category":"code","cwe":"CWE-943","file":"source/packages/server/src/handlers/pty.ts","line":103,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/packages/core/src/database/migration.ts","line":34,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/packages/core/src/database/migration.ts","line":49,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/packages/core/src/database/migration.ts","line":55,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/packages/core/src/database/migration.ts","line":91,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/packages/core/src/database/migration.ts","line":102,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/packages/core/src/database/migration.ts","line":105,"malware":false},{"ruleId":"redos-nested-quantifier","title":"regex with nested unbounded quantifiers","severity":"medium","category":"code","cwe":"CWE-1333","file":"source/packages/core/src/tool/bash.ts","line":79,"malware":false},{"ruleId":"js-dynamic-code-execution","title":"dynamic code execution","severity":"medium","category":"code","cwe":"CWE-95","file":"source/packages/effect-drizzle-sqlite/src/internal/drizzle-utils.ts","line":32,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/packages/effect-drizzle-sqlite/src/sqlite-core/effect/count.ts","line":11,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/packages/effect-drizzle-sqlite/src/sqlite-core/effect/count.ts","line":15,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/packages/effect-drizzle-sqlite/src/sqlite-core/effect/insert.ts","line":292,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/packages/effect-drizzle-sqlite/src/sqlite-core/effect/session.ts","line":455,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/packages/effect-drizzle-sqlite/src/sqlite-core/effect/session.ts","line":471,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/packages/effect-drizzle-sqlite/src/sqlite-core/effect/session.ts","line":489,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/packages/effect-drizzle-sqlite/src/up-migrations/effect-sqlite.ts","line":36,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/packages/effect-drizzle-sqlite/src/up-migrations/effect-sqlite.ts","line":44,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/packages/effect-drizzle-sqlite/src/up-migrations/effect-sqlite.ts","line":83,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/packages/effect-drizzle-sqlite/src/up-migrations/sqlite.ts","line":107,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/packages/effect-drizzle-sqlite/src/up-migrations/sqlite.ts","line":130,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/packages/effect-drizzle-sqlite/src/up-migrations/sqlite.ts","line":138,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/packages/effect-drizzle-sqlite/src/up-migrations/sqlite.ts","line":173,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/packages/effect-drizzle-sqlite/src/up-migrations/sqlite.ts","line":200,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/packages/effect-drizzle-sqlite/src/up-migrations/sqlite.ts","line":208,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/packages/effect-drizzle-sqlite/src/up-migrations/sqlite.ts","line":240,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/packages/kilo-docs/components/CodeBlock.tsx","line":62,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/packages/kilo-docs/pages/_app.tsx","line":168,"malware":false},{"ruleId":"js-timing-unsafe-mac-compare","title":"MAC or signature compared with ==","severity":"medium","category":"code","cwe":"CWE-208","file":"source/packages/kilo-indexing/src/indexing/manager.ts","line":497,"malware":false},{"ruleId":"insecure-randomness-for-secret","title":"predictable randomness used for a security value","severity":"medium","category":"code","cwe":"CWE-338","file":"source/packages/kilo-memory/src/storage/fs.ts","line":87,"malware":false},{"ruleId":"insecure-randomness-for-secret","title":"predictable randomness used for a security value","severity":"medium","category":"code","cwe":"CWE-338","file":"source/packages/kilo-memory/src/storage/fs.ts","line":170,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/packages/kilo-ui/src/components/message-part.tsx","line":2680,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/packages/kilo-ui/src/components/message-part.tsx","line":2778,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/packages/kilo-vscode/esbuild.js","line":384,"malware":false},{"ruleId":"js-timing-unsafe-mac-compare","title":"MAC or signature compared with ==","severity":"medium","category":"code","cwe":"CWE-208","file":"source/packages/kilo-vscode/webview-ui/diff-viewer/FileTree.tsx","line":129,"malware":false},{"ruleId":"js-dynamic-code-execution","title":"dynamic code execution","severity":"medium","category":"code","cwe":"CWE-95","file":"source/packages/kilo-vscode/webview-ui/src/components/chat/background-jobs.ts","line":46,"malware":false},{"ruleId":"js-dynamic-code-execution","title":"dynamic code execution","severity":"medium","category":"code","cwe":"CWE-95","file":"source/packages/kilo-vscode/webview-ui/src/context/image-models.tsx","line":31,"malware":false},{"ruleId":"js-dynamic-code-execution","title":"dynamic code execution","severity":"medium","category":"code","cwe":"CWE-95","file":"source/packages/kilo-vscode/webview-ui/src/context/speech-to-text-models.tsx","line":33,"malware":false},{"ruleId":"redos-nested-quantifier","title":"regex with nested unbounded quantifiers","severity":"medium","category":"code","cwe":"CWE-1333","file":"source/packages/llm/src/protocols/shared.ts","line":184,"malware":false},{"ruleId":"redos-nested-quantifier","title":"regex with nested unbounded quantifiers","severity":"medium","category":"code","cwe":"CWE-1333","file":"source/packages/opencode/src/acp/tool.ts","line":353,"malware":false},{"ruleId":"js-dynamic-code-execution","title":"dynamic code execution","severity":"medium","category":"code","cwe":"CWE-95","file":"source/packages/opencode/src/cli/cmd/debug/agent.handler.ts","line":110,"malware":false},{"ruleId":"redos-nested-quantifier","title":"regex with nested unbounded quantifiers","severity":"medium","category":"code","cwe":"CWE-1333","file":"source/packages/opencode/src/config/markdown.ts","line":6,"malware":false},{"ruleId":"redos-nested-quantifier","title":"regex with nested unbounded quantifiers","severity":"medium","category":"code","cwe":"CWE-1333","file":"source/packages/opencode/src/kilocode/auto-routing/eval-docker.ts","line":99,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/packages/opencode/src/kilocode/session/model-usage.ts","line":126,"malware":false},{"ruleId":"js-uninitialized-buffer","title":"buffer allocated without zeroing","severity":"medium","category":"code","cwe":"CWE-908","file":"source/packages/opencode/src/kilocode/tool/read-object.ts","line":59,"malware":false},{"ruleId":"js-uninitialized-buffer","title":"buffer allocated without zeroing","severity":"medium","category":"code","cwe":"CWE-908","file":"source/packages/opencode/src/kilocode/tool/read-object.ts","line":73,"malware":false},{"ruleId":"secret-hex-token","title":"High-entropy Hex Token","severity":"medium","category":"secret","cwe":"CWE-798","file":"source/packages/opencode/src/plugin/digitalocean.ts","line":7,"malware":false},{"ruleId":"redos-nested-quantifier","title":"regex with nested unbounded quantifiers","severity":"medium","category":"code","cwe":"CWE-1333","file":"source/packages/server/src/cors.ts","line":4,"malware":false},{"ruleId":"redos-nested-quantifier","title":"regex with nested unbounded quantifiers","severity":"medium","category":"code","cwe":"CWE-1333","file":"source/packages/server/src/kilocode/cors.ts","line":1,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/packages/session-ui/src/components/markdown.tsx","line":607,"malware":false},{"ruleId":"js-timing-unsafe-mac-compare","title":"MAC or signature compared with ==","severity":"medium","category":"code","cwe":"CWE-208","file":"source/packages/tui/src/context/theme.tsx","line":180,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/packages/ui/src/components/icon.tsx","line":144,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/packages/ui/src/components/markdown.tsx","line":160,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/packages/ui/src/components/markdown.tsx","line":667,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/packages/ui/src/context/marked.tsx","line":586,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/packages/ui/src/kilocode/markdown-stream-highlight.ts","line":36,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/packages/ui/src/kilocode/mermaid/markdown-mermaid-zoom.tsx","line":160,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/packages/ui/src/v2/components/icon.tsx","line":173,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/.github/docs-sync/selftest.mjs","line":664,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/.github/docs-sync/selftest.mjs","line":747,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/.github/docs-sync/selftest.mjs","line":786,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/.github/docs-sync/selftest.mjs","line":3308,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/.github/docs-sync/selftest.mjs","line":3616,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/.github/docs-sync/selftest.mjs","line":3779,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/.github/docs-sync/selftest.mjs","line":4086,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/.github/docs-sync/selftest.mjs","line":4322,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/.github/docs-sync/selftest.mjs","line":4356,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/.github/docs-sync/selftest.mjs","line":4435,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/.github/docs-sync/selftest.mjs","line":4551,"malware":false},{"ruleId":"secret-database-url","title":"Database URL with credentials","severity":"low","category":"secret","cwe":"CWE-798","file":"source/packages/codemode/test/codemode.test.ts","line":32,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"low","category":"code","cwe":"CWE-89","file":"source/packages/core/test/database-migration.test.ts","line":332,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"low","category":"code","cwe":"CWE-89","file":"source/packages/core/test/database-migration.test.ts","line":477,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"low","category":"code","cwe":"CWE-89","file":"source/packages/core/test/database-migration.test.ts","line":482,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"low","category":"code","cwe":"CWE-89","file":"source/packages/core/test/database-migration.test.ts","line":486,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"low","category":"code","cwe":"CWE-89","file":"source/packages/core/test/database-migration.test.ts","line":492,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"low","category":"code","cwe":"CWE-89","file":"source/packages/core/test/database-migration.test.ts","line":494,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"low","category":"code","cwe":"CWE-89","file":"source/packages/core/test/database-migration.test.ts","line":574,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"low","category":"code","cwe":"CWE-89","file":"source/packages/core/test/database-migration.test.ts","line":582,"malware":false}]}}