File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- dist/src/glm-realtime-provider.js:45
- Evidence
apiKey: [REDACTED] ?? envApiKey,
Security audit
GLM Realtime
Security checks for vulnerabilities and agentic risk
Overview
This plugin appears to be a coherent GLM Realtime voice provider that uses a user-supplied Zhipu API key to stream voice data to Zhipu's documented realtime endpoint.
Before installing, understand that voice audio, transcripts, prompts/instructions, and model tool-call context may be sent to Zhipu's GLM Realtime service using your ZHIPU_API_KEY. Install only if you intend to use that provider and are comfortable with that third-party data flow.
Static analysis
Detected: suspicious.exposed_secret_literal