ClawHub
Back to skill

Security audit

Kling

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to do the advertised video-generation task, but it should be reviewed because its authenticated HTTP client stack is reported vulnerable while sending prompts and an API key to a third-party service.

Review before installing. Use this only if you are comfortable sending prompts and generation settings to Kie.ai, avoid confidential or regulated content in prompts, and update or pin the HTTP dependencies to reviewed safe versions before using a KIE_API_KEY with it.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (7)

Known Vulnerable Dependency: axios==1.13.4 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High
Category
Supply Chain
Confidence
92% confidence
Finding
The lockfile pins axios 1.13.4, and the supplied advisory set includes multiple high-severity issues affecting request handling, proxy behavior, and prototype-pollution-related attack paths. Because axios is a core HTTP client library, flaws here can expose the skill to SSRF, credential leakage, request/response tampering, or MITM-style abuse depending on how network calls are implemented elsewhere in the skill.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High
Category
Supply Chain
Confidence
84% confidence
Finding
form-data 4.0.5 is reported as vulnerable to CRLF injection through unescaped multipart field names or filenames. If any part of multipart construction uses attacker-controlled input, this can let an attacker manipulate request bodies or inject unintended headers/parts, which may enable request smuggling or downstream parser abuse.

Known Vulnerable Dependency: axios==1.13.4 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High
Category
Supply Chain
Confidence
98% confidence
Finding
The skill permits resolution to axios 1.13.4, which is reported as having multiple security advisories, including SSRF-related and man-in-the-middle/prototype-pollution-related issues. Because this skill likely performs outbound API calls to a third-party video service, a vulnerable HTTP client increases the risk of request manipulation, credential leakage, or unsafe network behavior in agent environments.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill documentation explicitly routes user prompts to an external service (Kie.ai/Kling) but does not warn users that their inputs will leave the local environment and be processed by a third party. This creates a real privacy and data-handling risk because users may include confidential business, personal, or client information in prompts without informed consent or any guidance on acceptable data sharing.

External Transmission

Medium
Category
Data Exfiltration
Content
const axios = require('axios');

const API_KEY = process.env.KIE_API_KEY;
const BASE_URL = 'https://api.kie.ai/api/v1';

const client = axios.create({
  baseURL: BASE_URL,
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Known Vulnerable Dependency: follow-redirects==1.15.11 — 1 advisory(ies): CVE-2026-40895 (follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Ta)

Low
Category
Supply Chain
Confidence
81% confidence
Finding
follow-redirects 1.15.11 is flagged for leaking custom authentication headers across cross-domain redirects. In a skill that makes outbound HTTP requests, this can disclose bearer tokens, API keys, or other sensitive headers to attacker-controlled domains if redirects are followed automatically.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"version": "1.0.0",
  "description": "Kling AI video generation via Kie.ai",
  "dependencies": {
    "axios": "^1.6.0"
  }
}
Confidence
92% confidence
Finding
The dependency is specified with a caret range (^1.6.0), which allows npm to install newer 1.x releases automatically rather than locking to a reviewed version. In a security-sensitive skill, this weakens supply-chain control and can unexpectedly pull in vulnerable or malicious package updates.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
kling.js:4