Security audit
Security checks for vulnerabilities and agentic risk
This skill needs review because its examples can expose account credentials and cause unintended vehicle-control actions.
Have the temporary-file handling corrected before use: keep credentials and vehicle responses in a private temporary directory with restrictive permissions and cleanup. Verify the target vehicle and execute only the explicitly requested command; never run the combined examples wholesale. The saved refresh token enables continued account access. Both bundled files were reviewed, but the referenced external API document and claimed live behavior could not be verified.
references/requests.mdAuthentication credentials written to a shared temporary file without restrictive permissions
A local attacker can steal the session token and impersonate the account while that session remains valid, accessing vehicle information and supported remote commands. The durable refresh token is also disclosed.
The charging-status query matches the declared purpose, but the code also actively controls charging and modifies charge targets. These are substantive vehicle-control capabilities not disclosed by the description's charge-state reads or its listed lock, unlock, and climate commands. The general reference to commanding a vehicle does not clearly disclose these additional charging operations.
Referenced artifact was not completely inspected
**Ready-to-run request bodies and `jq` recipes: `references/requests.md`.**
Referenced artifact was not completely inspected
Source `references/requests.md`'s `kia_headers` helper rather than hand-rolling
The ready-to-run command examples place lock and unlock operations consecutively in the same executable block without requiring selection of the intended action. Copying or executing the whole block could leave the vehicle unlocked and also change climate operation, so the concern is unintended physical effects rather than merely missing warning text.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
with `chmod 600`. It is a credential: it re-authenticates the account without a
password prompt.
> Do **not** write it to `~/.kiaaccess-mcp/session.json`. That path belongs to the
> `kiaaccess-mcp` server, whose store is keyed by `accountId` with a different
> schema — overwriting it corrupts the server's session and forces it back
> through MFA.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
device id stable.
KIA_BASE='https://api.owners.kia.com/apigw/v1'
: "${KIA_DEVICE:?export KIA_DEVICE=\$(uuidgen) first}"
# Session file for THIS skill. Deliberately NOT ~/.kiaaccess-mcp/session.json —
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
done
}
# curl wrapper: kia_curl <method> <path> [body] [-- extra-header ...]
kia_curl() {
local method="$1" path="$2" body="${3:-}"
shift 2; [ $# -gt 0 ] && shift # drop the body arg when present
The wrapper writes response headers, including session and durable refresh tokens, to predictable /tmp/kia_hdrs without restrictive creation permissions, while other temporary files retain vehicle identifiers and location. Under common umasks these files can be readable by other local users, and predictable paths also permit precreation or symlink attacks; protecting the final session file does not protect these intermediate copies.