space-duck-kimi-relay

• Outcome: Review
• Latest audit: Aug 5, 2026 · 6:01 AM UTC
• Version: 0.4.0

Overview

This skill is mostly coherent for a local Kimi relay, but it needs review because it persists a token-using proxy, can store API keys in service files, and includes unrelated ClawHub credential-location metadata.

Install only if you want a local Kimi membership relay and are comfortable with local token storage. Avoid install-service unless you want a background proxy, check any OPENROUTER_API_KEY or KIMI_* variables before running it, and treat the token command output as a secret. The publisher should remove the ClawHub token path note from metadata before publication.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares no permissions, yet its documented behavior includes network access, file writes, environment variable handling, and service installation. That mismatch weakens reviewability and informed consent because operators may approve a seemingly simple login helper without realizing it can persist services, read secrets from env, and expose a local proxy.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The top-level description frames the skill primarily as a local sign-in add-on, but the body describes materially broader behavior: a long-running local proxy, optional third-party fallback routing, status/probe commands, and persistence via system services. This can mislead users about the operational and data-flow scope, especially since fallback may send prompts to OpenRouter and service installation makes the behavior persistent.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill description frames the tool as a local Kimi sign-in helper, but the code also exposes a local inference proxy, paid OpenRouter fallback, token printing, and service installation/removal. This scope expansion is security-relevant because users may grant trust appropriate for login-only functionality while unknowingly installing a persistent network-facing proxy with credential-handling behavior.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The file contains service installation and removal logic that persists the relay as a background process, which exceeds a narrow sign-in use case. Background persistence increases attack surface and can leave credential-using network services running longer than the user expects.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The note discloses a concrete local path where a ClawHub token is stored and instructs the publisher to use a specific HOME value to access it during publishing. Even though this is metadata rather than executable code, exposing credential storage details lowers the barrier for token discovery, accidental leakage, or misuse by anyone with access to the skill package or logs.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: install_service captures sensitive environment variables, including OPENROUTER_API_KEY, and writes them into launchd plist or systemd unit files as plaintext. Even with 0600 permissions, this expands secret exposure duration and creates an unexpected at-rest copy of API credentials that may be backed up, inspected by local tooling, or forgotten by the user.

Ssd 3

High

• Confidence: 99% confidence
• Finding: This note plainly reveals where a live authentication token resides and how to expose that location during publishing by overriding HOME. In the context of a skill specifically designed to relay access to a paid Kimi membership, that token is security-sensitive and could be stolen, reused, or accidentally bundled into artifacts, making the disclosure more dangerous than a generic filesystem reference.

Credential Access

High

• Category: Privilege Escalation

Content

Usage:
  kimi_login.py login          # interactive device sign-in
  kimi_login.py token          # print a fresh access token (auto-refresh)
  kimi_login.py probe          # one-line inference smoke on membership quota
  kimi_login.py serve [port]   # local proxy: point your runtime's OpenAI-
                               # compatible base URL at http://127.0.0.1:PORT/v1

• Confidence: 94% confidence
• Finding: access token

Session Persistence

Medium

• Category: Rogue Agent

Content

still get valid SSE. Without the env var, failures return the error so
your runtime's own ladder takes over.

For a proxy that survives reboots, `install-service` writes a systemd
user unit (Linux — enable lingering with
`loginctl enable-linger $USER` so it runs while logged out) or a
launchd agent (macOS). Any `OPENROUTER_API_KEY` / `KIMI_*` env vars set

• Confidence: 86% confidence
• Finding: systemd user unit (Linux — enable

Session Persistence

Medium

• Category: Rogue Agent

Content

if r.returncode != 0:
            print("launchctl load failed: " + (r.stderr or r.stdout), file=sys.stderr)
            return 1
        print(f"✅ launchd agent installed + started ({plist}), proxy on 127.0.0.1:{port}")
        return 0
    unit_dir = os.path.expanduser("~/.config/systemd/user")
    os.makedirs(unit_dir, exist_ok=True)

• Confidence: 93% confidence
• Finding: launchd agent install

Session Persistence

Medium

• Category: Rogue Agent

Content

print("(headless box? enable lingering: loginctl enable-linger $USER)",
                  file=sys.stderr)
            return 1
    print(f"✅ systemd user service installed + started ({unit}), proxy on 127.0.0.1:{port}")
    print("tip: sudo loginctl enable-linger $USER  # keeps it running after logout/reboot")
    return 0

• Confidence: 92% confidence
• Finding: systemd user service install

Session Persistence

Medium

• Category: Rogue Agent

Content

if r.returncode != 0:
            print("launchctl load failed: " + (r.stderr or r.stdout), file=sys.stderr)
            return 1
        print(f"✅ launchd agent installed + started ({plist}), proxy on 127.0.0.1:{port}")
        return 0
    unit_dir = os.path.expanduser("~/.config/systemd/user")
    os.makedirs(unit_dir, exist_ok=True)

• Confidence: 93% confidence
• Finding: plist

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.