T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/subagent_batch.py:159- Finding
Per-Task Timeout Is Declared but Never Enforced
- Content
View full analysis
- Remediation
View remediation
Security audit
kimi-k3-subagent
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent subagent framework, but it exposes broad child-agent powers and has implementation flaws that could weaken tool boundaries or run batches indefinitely.
Review before installing or using this as runtime code. It should be kept in a sandbox or patched first with explicit tool-permission enforcement, bounded concurrency, enforced timeouts, retry caps, and preservation of child-agent state across resume/retry. I found no evidence of exfiltration, remote code loading, persistence, or destructive install behavior.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/subagent_batch.py:207- Finding
Rate-Limited Tasks Can Retry Indefinitely with Unbounded Exponential Backoff
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/subagent_batch.py:292- Finding
Batch Concurrency Is Unlimited by Default
- Content
View full analysis
bool: """Whether the concurrency limit has been reached.""" if self.max_concurrency is None: return False return len(self.active) >= self.max_concurrency ``` ### Technical Analysis When `max_concurrency` is omitted, `_at_concurrency_limit()` always returns `False`. The normal scheduler immediately launches up to five tasks and then continues launching one task every 700 milliseconds, regardless of how many earlier tasks remain active. The constant `KIMI_CODE_AGENT_SWARM_MAX_CONCURRENCY` does not mitigate the issue because the audited code never reads or validates that environment variable. There is also no batch-size limit in `SubagentBatch`. If child operations are slow or stalled, active attempts accumulate. In a real integration, every attempt may consume memory, network connections, model-provider capacity, tool-execution capacity, and billable tokens. ### Attack Path 1. An attacker ...[truncated 831 chars]- Remediation
View remediation
HARD_MAX_CONCURRENCY: raise ValueError("Invalid maximum concurrency") self.max_concurrency = value ``` 3. Enforce a hard upper bound that callers and environment variables cannot exceed. 4. Reject batches larger than a configured maximum before allocating task state. 5. Prefer an `asyncio.Semaphore` for centralized concurrency enforcement. 6. Combine concurrency controls with task timeouts and cancellation so stalled children cannot retain slots indefinitely. 7. Apply per-user or per-tenant quotas where the scheduler is exposed to multiple users. 8. Add load tests covering large batches, slow children, stalled children, invalid environment values, and attempts to override the hard concurrency ceiling. ]]>
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (11)
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md # Kimi K3 Code Subagent 架构学习笔记 > 学习来源: github.com/MoonshotAI/kimi-code (MIT协议, TypeScript) > 核心包: packages/agent-core/src/session/subagent-host.ts, subagent-batch.ts
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md # Kimi K3 Code Subagent 架构学习笔记 > 学习来源: github.com/MoonshotAI/kimi-code (MIT协议, TypeScript) > 核心包: packages/agent-core/src/session/subagent-host.ts, subagent-batch.ts
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly advertises a 'coder' subagent with write/edit capabilities but provides no warning, permission model, or usage constraints around modifying local files. In an agentic environment, this increases the chance that users invoke a file-mutating agent without understanding that it can change repository contents, overwrite files, or introduce unintended persistence.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill documents bash-capable execution for the 'coder' subagent without any warning about shell-command risk, environment access, or destructive operations. Because shell access can execute arbitrary commands, exfiltrate data, alter files, or invoke networked tools, omitting a clear warning and guardrails materially increases operational risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The top-level natural-language documentation is entirely in Chinese, including the module description and operational comments, which indicates a fixed language choice rather than offering user-selectable locale behavior. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
start_btw creates a text-only agent with tools_disabled=True, but resume/retry obtain agent state through _get_child_agent, which returns a new object with tools_disabled=False and profile_name='subagent'. This can silently upgrade a restricted side-channel agent into a tool-capable one, violating the intended trust boundary and potentially enabling unauthorized tool execution.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
_get_child_agent is documented and used as though it retrieves persisted child-agent state, but it instead fabricates a fresh default dict. That breaks resume/retry semantics, loses security-relevant state such as tool restrictions and prior turns, and can cause policy bypass when later code assumes the returned object reflects the real suspended agent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This Python file contains natural-language descriptions and usage guidance entirely in Chinese in the module docstring and profile metadata. Under the policy, forcing a specific language without user opt-in or justification is a language/locale policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The user-facing profile description and when-to-use fields for multiple built-in subagents are encoded entirely in Chinese, with no alternative language or opt-in mechanism. That imposes a specific language on users and downstream consumers without an explicit documented locale constraint.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file is entirely written in Chinese, including the title and all operational descriptions, with no indication that language selection is optional or that the document is intended for a specific Chinese-only audience. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The file’s top-level docstring and many inline comments are written only in Chinese, which imposes a specific language on operators and maintainers without any stated opt-in or region-specific justification. Under the policy, language constraints should either offer choice or be clearly documented as intentional and necessary.
- Content