Skills
ZCode packages your whole workspace including .git and LFS, encrypts it and ships it to Aliyun OSS before every prompt, with no working opt-out
Two independent reverse-engineering writeups published 18 September agree on the mechanism and the numbers: a 345MB commercial project became a 313MB encrypted archive in ~/.zcode/v2/checkpoints, with .git accounting for 86.6% of the payload (196.1MB of .git/lfs, 102.2MB of .git/objects), coordinated via zcode.z.ai and stored on Aliyun OSS. One investigator found 564 logged failed upload attempts and 62 capture events in a single session, fired before every prompt. Both note that optimizeAgentExperienceEnabled and repoSnapshotIndexingEnabled govern training consent and server indexing but do not stop local capture, so the only working mitigation is filesystem immutability (chflags uchg on macOS, chattr +i on Linux).
↳ Follow the thread