Security audit

Kimi CLI 无头执行操作手册

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Kimi CLI automation guide, but its recommended headless modes can grant automatic file changes and shell execution without enough scoping or containment.

Review before installing. Use this skill only in trusted, isolated project directories, avoid CI environments with secrets unless tightly sandboxed, and require explicit approval before any --quiet, --print, or --yolo run that could modify files or execute commands. Verify the Kimi CLI package source and prefer pinned, isolated installation.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:81
Finding: Recommended Headless Modes Implicitly Enable Unrestricted File and Shell Operations
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:132
Finding: User-Controlled Task and Path Values Are Interpolated into Shell Commands Without Safe Escaping
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:228
Finding: Unpinned Third-Party CLI Installation Is Recommended Without Integrity Verification
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file declares language: zh-CN and presents the skill entirely in Chinese, which effectively imposes a specific language/locale on use of the skill. The document does not state that users may choose another language or that the locale restriction is required for a region-specific purpose.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 88% confidence
Finding: The skill explicitly supports an auto_approve input that maps to --yolo, which authorizes file modifications and shell command execution in headless mode. In automation, CI/CD, or non-interactive environments, this can remove human approval gates and allow destructive or unintended actions if the prompt, workspace, or model output is unsafe or manipulated.
Content: Scanner excerpt · SKILL.md (reported line 270)May include surrounding context.
md
type: string enum: [quiet, print, stream-json, wire] description: 输出模式选择 auto_approve: type: boolean description: 是否启用 --yolo 自动审批 model: