ClawHub
Back to skill

Security audit

Kilo Code

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward reference for using the Kilo CLI, with risky flags disclosed rather than hidden or encouraged.

Install only if you already intend to use the Kilo CLI from Codex. Be careful with --auto, --command, --share, and cloud session options because they can approve shell actions, run specific commands, share sessions, or involve cloud state; prefer explicit per-run approval and scoped project directories.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md
| `--title TITLE`            | Label the session (truncated prompt if no value).                                   |
| `-f, --file PATH`          | Attach files to the message.                                                        |
| `--thinking`               | Surface reasoning blocks.                                                           |
| `--auto`                   | Auto-approve non-denied permissions (dangerous — see _Common gotchas_).             |
| `--command CMD`            | Run a specific command; the `message` becomes the args.                             |
| `--share`                  | Share the session via a generated URL.                                              |
| `--cloud-fork`             | Fetch the named session from the cloud and continue locally (requires `--session`). |

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

md
## Common gotchas

- **`kilo run` without `--format json` prints human-friendly output.** For pipelines, always pass `--format json` and parse stdout.
- **`--auto` is dangerous.** It auto-approves every permission not explicitly denied, including shell execution. Use only in disposable sandboxes.
- **Cwd matters.** `kilo run` reads `--dir` for the working dir; omit it and the call falls back to the parent's cwd, which is rarely what you want.
- **TUI / ACP / auth / MCP / agent-create / upgrade / uninstall paths are not in this skill.** Hand them to a human operator or gate them behind explicit per-call approval.

Static analysis

No suspicious patterns detected.