ClawHub
Back to skill

Security audit

Kimi Search

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Kimi web-search integration, but it can make repeated paid API calls without a local limit.

Install only if you are comfortable sending search queries to Moonshot and paying for Moonshot API/search usage. Prefer an isolated virtual environment, protect and rotate MOONSHOT_API_KEY, and consider adding a local request/tool-call limit before regular use.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:23
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23-34
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

bash
pip3 install openai

The alternative virtual-environment instructions repeat the same unpinned installation:

bash
python3 -m venv ~/.openclaw/skills/kimi-search/venv
source ~/.openclaw/skills/kimi-search/venv/bin/activate
pip install openai

Technical Analysis

The documented installation process retrieves the latest available openai package and its transitive dependencies without a version constraint, lockfile, or package-hash verification. Consequently, the code installed by users can change after this Skill has been reviewed.

This does not establish that the current package is malicious. However, it creates a supply-chain exposure in which a compromised, malicious, or unexpectedly incompatible future package release could be installed automatically. Python packages may execute code during installation or when imported by scripts/kimi-search.py.

Attack Path

  1. An attacker compromises a future release of the named package or one of its transitive dependencies.
  2. A user follows the Skill documentation and runs pip3 install openai or pip install openai.
  3. The package manager retrieves the affected release because no reviewed version or hash is required.
  4. Malicious package code executes during installation or when the script imports the package.
  5. The code operates with the privileges and environment access of the user running the installation or Skill.

Impact Assessment

Successful exploitation could allow arbitrary code execution with the installing user's privileges. Depending on that user's access, the payload could read environment variables such as MOONSHOT_API_KEY, access user-readable files, alter the Python environment, or make network requests. The scope is limited by the privileges and sand ...[truncated 61 chars]

Remediation
View remediation

Remediation Suggestions

  • Add a dependency manifest that pins the openai package and all transitive dependencies to reviewed versions.
  • Generate and verify cryptographic hashes, such as by using pip install --require-hashes -r requirements.txt.
  • Use a reproducible lockfile and review dependency changes before updating it.
  • Install dependencies from the official package index over TLS and avoid untrusted additional indexes.
  • Run the Skill in an isolated virtual environment under a least-privileged account.
  • Add automated dependency vulnerability and integrity scanning to the release process.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/kimi-search.py:55
Finding

Unbounded Billable API Tool-Call Loop

Content
View full analysis

Vulnerability Details

File Location: scripts/kimi-search.py, lines 55-84
Vulnerability Type: Unbounded externally controlled iteration and resource consumption
Risk Level: Medium

Vulnerable Code

python
while finish_reason is None or finish_reason == "tool_calls":
    completion = client.chat.completions.create(
        model="kimi-k2-turbo-preview",
        messages=messages,
        temperature=0.6,
        tools=tools,
    )
    
    choice = completion.choices[0]
    finish_reason = choice.finish_reason
    
    if finish_reason == "tool_calls":
        # 模型要求执行工具调用
        messages.append(choice.message)
        
        for tool_call in choice.message.tool_calls:
            tool_call_name = tool_call.function.name
            tool_call_arguments = json.loads(tool_call.function.arguments)
            
            if tool_call_name == "$web_search":
                # 对于内置工具，原样返回参数即可
                tool_result = tool_call_arguments
            else:
                tool_result = {"error": f"Unknown tool: {tool_call_name}"}
            
            # 将工具执行结果返回给模型
            messages.append({
                "role": "tool",
                "tool_call_id": tool_call.id,
                "name": tool_call_name,
                "content": json.dumps(tool_result),
            })

Technical Analysis

Loop termination is controlled entirely by the remote model's finish_reason. Every response containing tool_calls causes the script to append more messages and issue another paid API request. The implementation does not enforce a maximum iteration count, maximum tool-call count, cumulative token or cost budget, or explicit overall execution deadline.

Because user-controlled query text influences model behavior, an adversarial or unusually complex query may induce repeated tool calls. A malfunctioning or compromised upstream service could have the sam ...[truncated 1380 chars]

Remediation
View remediation

Remediation Suggestions

  • Enforce a small, explicit maximum number of API rounds and total tool calls.
  • Abort safely with a structured error once the configured limit is reached.
  • Configure per-request timeouts and an overall workflow deadline.
  • Track cumulative prompt tokens, completion tokens, search calls, and estimated cost across every iteration.
  • Stop processing when a configurable token or monetary budget is exceeded.
  • Limit conversation growth and reject unexpectedly large tool arguments.
  • Validate that each tool call has the expected name and argument structure before returning it to the model.
  • Add monitoring and rate limits per user or invocation to detect repeated high-cost requests.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
80% confidence
Finding

The skill declares and relies on access to the MOONSHOT_API_KEY environment variable, but the manifest does not define an explicit tool scope such as permissions or allowed-tools. This creates a policy gap where sensitive capabilities are used without clear least-privilege declaration, making review and enforcement harder and increasing the chance of unintended secret exposure or misuse in broader skill execution contexts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The natural-language description and usage examples are presented only in Chinese, and the system prompt also fixes the assistant identity in Chinese. This creates a locale/language constraint without any opt-in, alternative language path, or justification that the skill is intended only for a Chinese-speaking context.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/kimi-search.py (reported line 33)May include surrounding context.

python
client = OpenAI(
        api_key=api_key,
        base_url="https://api.moonshot.cn/v1",
    )
    
    messages = [

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This code transmits the user's query to the Moonshot API and invokes a built-in web search capability, which can expose user-provided content to external services. Although the module docstring says it performs web search, the script provides no runtime disclosure, confirmation, or explicit privacy warning before sending the query.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The description is written as an instruction to use the skill for searches and states that it supports Chinese and English queries, but the surrounding documentation and examples consistently assume Chinese usage without offering the user an explicit language choice. This can be read as a locale/language default imposed by the skill rather than an opt-in preference.

Content

No source excerpt is available for this finding.