w3bs.AccountStart building
PACKAGES / Kilo Code

Kilo Code CLI

Terminal version of the open source Kilo Code agentic engineering platform.

ThreatCrush · No malware found
INSTALLw3bs install kilo.ai/kilo

No w3bs yet? curl -fsSL https://w3bs.org/install.sh | sh

Get started

What to type once it is installed.

  1. w3bs install kilo.ai/kiloInstall Kilo Code CLI and track it for updates
  2. kiloStart the interactive terminal UI in the current directory
  3. kilo authManage provider credentials
  4. kilo run "<task>"Run a task with a message without opening the TUI
  5. kilo --continueResume the most recent session in this workspace

Every option: kilo --help · docs ↗

Malware scan

ThreatCrush found no malware indicators in Kilo Code CLI 7.8.18. The other findings below are ordinary code-review notes, not malware.

Scanned
2026-11-02 22:59 UTC · threatcrush 0.13.30
Files
8515 (installer + github.com/Kilo-Org/kilocode@2df562cb336d)
Findings
24 high · 56 medium · 161 low
100+ other findings (not malware)
  • high
    Hardcoded Credentialsource/.github/docs-sync/selftest.mjs:712secret-generic-credential · CWE-798
  • high
    Hardcoded Credentialsource/.github/docs-sync/selftest.mjs:713secret-generic-credential · CWE-798
  • high
    outbound request to a non-constant URLsource/packages/core/src/oauth/page.ts:127js-ssrf-outbound-request · CWE-918
  • high
    Generic API Keysource/packages/kilo-docs/pages/ai-providers/cloudflare.md:48secret-generic-api-key · CWE-798
  • high
    Hardcoded Credentialsource/packages/kilo-e2e/src/scenarios.ts:68secret-generic-credential · CWE-798
  • high
    Hardcoded Credentialsource/packages/kilo-e2e/src/scenarios.ts:77secret-generic-credential · CWE-798
  • high
    Hardcoded Credentialsource/packages/kilo-e2e/src/scenarios.ts:86secret-generic-credential · CWE-798
  • high
    Hardcoded Credentialsource/packages/kilo-gateway/src/edit-prompt.ts:22secret-generic-credential · CWE-798
  • high
    Generic API Keysource/packages/kilo-telemetry/src/client.ts:8secret-generic-api-key · CWE-798
  • high
    TLS certificate verification disabledsource/packages/kilo-vscode/src/services/cli-backend/server-manager.ts:134tls-verification-disabled · CWE-295
  • high
    Hardcoded Credentialsource/packages/kilo-vscode/webview-ui/src/components/settings/mcp-oauth-config.ts:77secret-generic-credential · CWE-798
  • high
    dependency name close to a popular packagesource/packages/opencode/package.json:182manifest-typosquat · CWE-1357
  • high
    outbound request to a non-constant URLsource/packages/opencode/src/plugin/digitalocean.ts:93js-ssrf-outbound-request · CWE-918
  • high
    NoSQL query built from request datasource/packages/opencode/src/server/routes/instance/httpapi/handlers/pty.ts:120js-nosql-injection · CWE-943
  • high
    NoSQL query built from request datasource/packages/opencode/src/server/routes/instance/httpapi/handlers/pty.ts:138js-nosql-injection · CWE-943
  • high
    response header set from request inputsource/packages/opencode/src/server/routes/instance/httpapi/handlers/session.ts:162js-header-injection · CWE-113
  • high
    NoSQL query built from request datasource/packages/opencode/src/server/routes/instance/httpapi/handlers/session.ts:205js-nosql-injection · CWE-943
  • high
    NoSQL query built from request datasource/packages/opencode/src/server/routes/instance/httpapi/handlers/workspace.ts:61js-nosql-injection · CWE-943
  • high
    NoSQL query built from request datasource/packages/server/src/handlers/credential.ts:11js-nosql-injection · CWE-943
  • high
    NoSQL query built from request datasource/packages/server/src/handlers/credential.ts:18js-nosql-injection · CWE-943
  • high
    NoSQL query built from request datasource/packages/server/src/handlers/fs.ts:35js-nosql-injection · CWE-943
  • high
    NoSQL query built from request datasource/packages/server/src/handlers/permission.ts:93js-nosql-injection · CWE-943
  • high
    NoSQL query built from request datasource/packages/server/src/handlers/pty.ts:82js-nosql-injection · CWE-943
  • high
    NoSQL query built from request datasource/packages/server/src/handlers/pty.ts:103js-nosql-injection · CWE-943
  • medium
    SQL built from a template literal or f-stringsource/packages/core/src/database/migration.ts:34sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/core/src/database/migration.ts:49sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/core/src/database/migration.ts:55sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/core/src/database/migration.ts:91sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/core/src/database/migration.ts:102sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/core/src/database/migration.ts:105sql-template-interpolation · CWE-89
  • medium
    regex with nested unbounded quantifierssource/packages/core/src/tool/bash.ts:79redos-nested-quantifier · CWE-1333
  • medium
    dynamic code executionsource/packages/effect-drizzle-sqlite/src/internal/drizzle-utils.ts:32js-dynamic-code-execution · CWE-95
  • medium
    SQL built from a template literal or f-stringsource/packages/effect-drizzle-sqlite/src/sqlite-core/effect/count.ts:11sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/effect-drizzle-sqlite/src/sqlite-core/effect/count.ts:15sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/effect-drizzle-sqlite/src/sqlite-core/effect/insert.ts:292sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/effect-drizzle-sqlite/src/sqlite-core/effect/session.ts:455sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/effect-drizzle-sqlite/src/sqlite-core/effect/session.ts:471sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/effect-drizzle-sqlite/src/sqlite-core/effect/session.ts:489sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/effect-drizzle-sqlite/src/up-migrations/effect-sqlite.ts:36sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/effect-drizzle-sqlite/src/up-migrations/effect-sqlite.ts:44sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/effect-drizzle-sqlite/src/up-migrations/effect-sqlite.ts:83sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/effect-drizzle-sqlite/src/up-migrations/sqlite.ts:107sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/effect-drizzle-sqlite/src/up-migrations/sqlite.ts:130sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/effect-drizzle-sqlite/src/up-migrations/sqlite.ts:138sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/effect-drizzle-sqlite/src/up-migrations/sqlite.ts:173sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/effect-drizzle-sqlite/src/up-migrations/sqlite.ts:200sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/effect-drizzle-sqlite/src/up-migrations/sqlite.ts:208sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/effect-drizzle-sqlite/src/up-migrations/sqlite.ts:240sql-template-interpolation · CWE-89
  • medium
    unescaped HTML renderingsource/packages/kilo-docs/components/CodeBlock.tsx:62js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/packages/kilo-docs/pages/_app.tsx:168js-unescaped-html-sink · CWE-79
  • medium
    MAC or signature compared with ==source/packages/kilo-indexing/src/indexing/manager.ts:497js-timing-unsafe-mac-compare · CWE-208
  • medium
    predictable randomness used for a security valuesource/packages/kilo-memory/src/storage/fs.ts:87insecure-randomness-for-secret · CWE-338
  • medium
    predictable randomness used for a security valuesource/packages/kilo-memory/src/storage/fs.ts:170insecure-randomness-for-secret · CWE-338
  • medium
    unescaped HTML renderingsource/packages/kilo-ui/src/components/message-part.tsx:2680js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/packages/kilo-ui/src/components/message-part.tsx:2778js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/packages/kilo-vscode/esbuild.js:384js-unescaped-html-sink · CWE-79
  • medium
    MAC or signature compared with ==source/packages/kilo-vscode/webview-ui/diff-viewer/FileTree.tsx:129js-timing-unsafe-mac-compare · CWE-208
  • medium
    dynamic code executionsource/packages/kilo-vscode/webview-ui/src/components/chat/background-jobs.ts:46js-dynamic-code-execution · CWE-95
  • medium
    dynamic code executionsource/packages/kilo-vscode/webview-ui/src/context/image-models.tsx:31js-dynamic-code-execution · CWE-95
  • medium
    dynamic code executionsource/packages/kilo-vscode/webview-ui/src/context/speech-to-text-models.tsx:33js-dynamic-code-execution · CWE-95
  • medium
    regex with nested unbounded quantifierssource/packages/llm/src/protocols/shared.ts:184redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/packages/opencode/src/acp/tool.ts:353redos-nested-quantifier · CWE-1333
  • medium
    dynamic code executionsource/packages/opencode/src/cli/cmd/debug/agent.handler.ts:110js-dynamic-code-execution · CWE-95
  • medium
    regex with nested unbounded quantifierssource/packages/opencode/src/config/markdown.ts:6redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/packages/opencode/src/kilocode/auto-routing/eval-docker.ts:99redos-nested-quantifier · CWE-1333
  • medium
    SQL built from a template literal or f-stringsource/packages/opencode/src/kilocode/session/model-usage.ts:126sql-template-interpolation · CWE-89
  • medium
    buffer allocated without zeroingsource/packages/opencode/src/kilocode/tool/read-object.ts:59js-uninitialized-buffer · CWE-908
  • medium
    buffer allocated without zeroingsource/packages/opencode/src/kilocode/tool/read-object.ts:73js-uninitialized-buffer · CWE-908
  • medium
    High-entropy Hex Tokensource/packages/opencode/src/plugin/digitalocean.ts:7secret-hex-token · CWE-798
  • medium
    regex with nested unbounded quantifierssource/packages/server/src/cors.ts:4redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/packages/server/src/kilocode/cors.ts:1redos-nested-quantifier · CWE-1333
  • medium
    unescaped HTML renderingsource/packages/session-ui/src/components/markdown.tsx:607js-unescaped-html-sink · CWE-79
  • medium
    MAC or signature compared with ==source/packages/tui/src/context/theme.tsx:180js-timing-unsafe-mac-compare · CWE-208
  • medium
    unescaped HTML renderingsource/packages/ui/src/components/icon.tsx:144js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/packages/ui/src/components/markdown.tsx:160js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/packages/ui/src/components/markdown.tsx:667js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/packages/ui/src/context/marked.tsx:586js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/packages/ui/src/kilocode/markdown-stream-highlight.ts:36js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/packages/ui/src/kilocode/mermaid/markdown-mermaid-zoom.tsx:160js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/packages/ui/src/v2/components/icon.tsx:173js-unescaped-html-sink · CWE-79
  • low
    Hardcoded Credentialsource/.github/docs-sync/selftest.mjs:664secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/.github/docs-sync/selftest.mjs:747secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/.github/docs-sync/selftest.mjs:786secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/.github/docs-sync/selftest.mjs:3308secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/.github/docs-sync/selftest.mjs:3616secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/.github/docs-sync/selftest.mjs:3779secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/.github/docs-sync/selftest.mjs:4086secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/.github/docs-sync/selftest.mjs:4322secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/.github/docs-sync/selftest.mjs:4356secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/.github/docs-sync/selftest.mjs:4435secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/.github/docs-sync/selftest.mjs:4551secret-generic-credential · CWE-798
  • low
    Database URL with credentialssource/packages/codemode/test/codemode.test.ts:32secret-database-url · CWE-798
  • low
    SQL built from a template literal or f-stringsource/packages/core/test/database-migration.test.ts:332sql-template-interpolation · CWE-89
  • low
    SQL built from a template literal or f-stringsource/packages/core/test/database-migration.test.ts:477sql-template-interpolation · CWE-89
  • low
    SQL built from a template literal or f-stringsource/packages/core/test/database-migration.test.ts:482sql-template-interpolation · CWE-89
  • low
    SQL built from a template literal or f-stringsource/packages/core/test/database-migration.test.ts:486sql-template-interpolation · CWE-89
  • low
    SQL built from a template literal or f-stringsource/packages/core/test/database-migration.test.ts:492sql-template-interpolation · CWE-89
  • low
    SQL built from a template literal or f-stringsource/packages/core/test/database-migration.test.ts:494sql-template-interpolation · CWE-89
  • low
    SQL built from a template literal or f-stringsource/packages/core/test/database-migration.test.ts:574sql-template-interpolation · CWE-89
  • low
    SQL built from a template literal or f-stringsource/packages/core/test/database-migration.test.ts:582sql-template-interpolation · CWE-89

Showing the first 100 findings.

Badge for your README

ThreatCrush: No malware found

[![ThreatCrush scan](https://w3bs.org/api/packages/kilo.ai/kilo/badge.svg)](https://w3bs.org/packages/kilo.ai/kilo)