zai-web-research

The stated purpose is coherent: web research via Z.ai-backed search/reader tools. Main concern is trust in the required local `zai` CLI, whose exact provenance is not established by the provided evidence, combined with untrusted web-content ingestion while Bash is available. This is better classified as suspicious/high-risk supply-chain and agent-safety exposure than confirmed malware.