ClawHub
Back to skill

Security audit

kimi-k3-subagent

Security checks across malware telemetry and agentic risk

Overview

The skill is a disclosed subagent-scheduling reference implementation, with some correctness and safety-documentation gaps but no evidence of hidden, destructive, or exfiltrating behavior.

Install only if you want a subagent scheduling/reference implementation. Treat the shell/write-capable profiles as powerful: use them in a scoped workspace, review prompts before launching background or batch work, and do not rely on resume/retry preserving real prior context until that implementation is corrected.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
`resume()` claims to restore an existing sub-agent, but `_get_child_agent()` fabricates a new default child state with an empty `turn` history instead of retrieving persisted state. This breaks lifecycle integrity: callers may believe they are resuming prior context, while the agent actually runs without prior memory or safeguards, which can cause incorrect actions, policy bypass assumptions, or loss of auditability.

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
`retry()` does not confirm that the sub-agent is actually in a failed state, and it resets `child["turn"]` on a fabricated default child returned by `_get_child_agent()`. This can misrepresent execution history, discard context, and allow workflows to proceed under false assumptions about what was retried, undermining correctness, traceability, and potentially safety controls tied to prior state.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly advertises a 'coder' subagent with write/edit/bash capabilities, which can modify files and execute shell commands, but it does not warn users about those side effects or recommend confirmation/sandboxing before use. In an agent skill, undisclosed command and file-modification capabilities increase the chance of unsafe invocation, prompt-induced misuse, or accidental destructive actions.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.