Kimi Cli Headless Execution

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:20 AM UTC
• Version: 0.0.1

Overview

The skill is a coherent Kimi CLI automation guide, but it normalizes headless modes that can automatically approve file changes and shell commands.

Install only if you intentionally want a Chinese-language guide for running Kimi CLI in non-interactive automation. Treat `--quiet`, `--print`, and `--yolo` as potentially mutation-capable: use them only in a scoped project directory or disposable CI workspace, avoid privileged accounts and home/system roots, and review package provenance before installing `kimi-cli`.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:81

Finding

Headless modes implicitly enable unrestricted automatic approval

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 81-82, 94, 127, 156, 162, and 216-217
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: High

Vulnerable Snippet

text

Line 81: --print runs in non-interactive Print mode and implicitly enables --yolo.
Line 82: --quiet is equivalent to --print --output-format text --final-message-only.
Line 94: The recommended default for a quick request is: kimi -p "task description" --quiet
Line 127: Headless mode must add --yolo, or rely on --print implicitly enabling --yolo.
Line 156: kimi -p "analyze the architecture and potential issues in this project" --quiet
Line 162: kimi -p "add unit tests to this project" --print
Lines 216-217: Prefer --quiet by default unless the user explicitly requests process output.

Technical Analysis

The skill states that --print implicitly enables --yolo, while --quiet is defined as a derivative of --print. It then recommends --quiet as the default mode and provides --print examples for repository-level tasks.

Consequently, commands presented as output-format choices may also automatically approve file changes and shell execution. This conflicts with the skill's separate requirement to obtain explicit user confirmation before enabling YOLO behavior. A user or agent may reasonably select --quiet only to suppress verbose output without realizing that it also changes the command-approval security boundary.

The affected execution inherits the privileges of the account running Kimi CLI. No privilege escalation is demonstrated, but the CLI may perform automatically approved operations available to that account.

Attack Path

1. A user asks the agent to analyze or work on a project in headless mode.
2. Following the documented default, the agent constructs a command using --quiet or --print.
3. According to the skill, that mode implicitly enables YOLO behavior.
4. Kimi CLI genera ...[truncated 889 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not recommend --quiet or --print as safe defaults if either mode implicitly enables automatic approval.
2. Explicitly document the approval behavior beside every example using these modes.
3. Require affirmative user consent immediately before executing any mode that enables YOLO behavior.
4. Separate read-only analysis examples from mutation-capable examples. Use a mode that preserves approval checks for read-only work, if supported.
5. If Kimi CLI cannot perform non-interactive execution without automatic approval, state that limitation clearly and require sandboxing rather than presenting the mode as a normal output preference.
6. Restrict execution to an explicitly validated --work-dir, preferably a disposable copy, temporary checkout, container, or other sandbox.
7. Refuse YOLO execution in home-directory roots, system directories, credential directories, and repositories containing untrusted content.
8. Run the CLI as an unprivileged account with minimal filesystem and network permissions.
9. Revise examples so that potentially mutating tasks include an explicit consent checkpoint before command construction.
10. Add post-execution verification, such as reviewing filesystem changes and preserving a recoverable version-control state.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:232

Finding

Unpinned third-party package installation recommendation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 232
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Snippet

bash

pip install kimi-cli

Technical Analysis

The failure-handling instructions recommend installing kimi-cli without pinning a version, validating package provenance, verifying hashes, or requiring an isolated environment. The command therefore resolves whichever package release and transitive dependency versions the configured package index considers current at installation time.

Package installation can execute package build logic and subsequently introduces executable code into the environment. If the named package, one of its dependencies, the configured package index, or a future release is compromised, following this instruction may install attacker-controlled code. The audit does not establish that the current kimi-cli package is malicious; the issue is the unsafe, non-reproducible installation practice.

Attack Path

1. Kimi CLI is absent from the target environment.
2. The user follows the skill's recovery instruction and runs pip install kimi-cli.
3. pip resolves an unpinned release and its dependencies from the configured index.
4. A compromised or malicious package release, dependency, index response, or build artifact is downloaded.
5. Package installation or later CLI invocation executes attacker-controlled code with the permissions of the account running pip or kimi.
6. If installation is performed with elevated privileges, the resulting compromise may extend to system-wide Python files and other privileged resources.

Impact Assessment

A compromised dependency could execute arbitrary code as the installing user, access that user's files and credentials, alter the Python environment, tamper with project data, or install additional malicious components. The normal scope is the invoking user's environment; system-wid ...[truncated 121 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the unpinned command with the exact package name and version specified by the official Kimi CLI documentation.
2. Pin all direct and transitive dependencies through a reviewed lock file or constraints file.
3. Require artifact hash verification, such as pip install --require-hashes -r requirements.txt.
4. Direct users to a verified official package page or installation guide and instruct them to validate the publisher and package identity.
5. Install into an isolated virtual environment or pipx environment rather than the system Python environment.
6. Do not recommend sudo pip install or installation under an administrative account.
7. Consider an internally mirrored and security-scanned package repository for CI/CD use.
8. Add dependency vulnerability and provenance checks to automated environments before installation.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 87% confidence

Finding

The skill explicitly models an auto_approve option that maps to --yolo, which authorizes file modifications and shell command execution without interactive confirmation in headless environments. Even though the document includes warnings, exposing autonomous approval as a normal parameter in an automation skill materially increases the chance that an agent or pipeline will execute destructive or unsafe actions at scale.

Content

Scanner excerpt · SKILL.md (reported line 270)May include surrounding context.

md

type: string
      enum: [quiet, print, stream-json, wire]
      description: 输出模式选择
    auto_approve:
      type: boolean
      description: 是否启用 --yolo 自动审批
    model:

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file explicitly sets language: zh-CN and presents the skill entirely in Chinese, with no indication that the user can choose another language or opt in to this locale. Per the policy, forcing a specific language without user choice is a natural-language policy concern unless the locale restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.