zk-model-pass

This is a local file-receiving server, likely intended to save screenshots. It does not show evidence of malware or data exfiltration. Its unauthenticated write capability, permissive CORS/private-network headers, and unbounded body reads present security risks; exposure is limited by binding to localhost and checking that destinations remain under the configured root.