T03 · Remote Payload Retrieval and Execution
Error
- Location
README.md:42- Finding
Unverified Remote Installer Is Executed Directly by a Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
openclaw-kirocli-coding-agent
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent coding-agent integration, but it repeatedly recommends no-confirmation, unsandboxed, and unrestricted-tool modes plus unsafe installer patterns that need review before use.
Install only if you are comfortable with OpenClaw launching powerful coding agents. Prefer confirmation-enabled or allowlisted tool modes, avoid `--yolo` and `--trust-all-tools` except in isolated sandboxes, review before any commit/push/PR action, and avoid pipe-to-shell or unpinned global installs when setting up prerequisites.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:103- Finding
Coding Agents Are Instructed to Run Without Approval or Sandbox Boundaries
- Content
View full analysis
. Commit and push.'" bash pty:true workdir:/tmp/issue-99 background:true command:"pnpm install && codex --yolo 'Fix issue #99: . Commit and push.'" ``` ### Technical Analysis The Skill explicitly describes `--yolo` as disabling both sandboxing and approvals, while repeatedly recommending `--trust-all-tools` for Kiro automation. These settings grant coding agents broad access to shell execution and filesystem operations without requiring confirmation for each sensitive action. This exceeds least privilege fo ...[truncated 2277 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:481- Finding
Unpinned Global NPM Package Installation Creates Supply-Chain Exposure
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
Findings (29)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
The README recommends
curl -fsSL https://cli.kiro.dev/install | bash, which executes remote script content directly without prior inspection or integrity verification. If the distribution endpoint, transport, or upstream script is compromised, users may immediately run arbitrary attacker-controlled code on their system.- Content
bash # macOS / Linux (recommended) curl -fsSL https://cli.kiro.dev/install | bash # Or download from https://kiro.dev/
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
The
| bashpattern creates a direct chain from network retrieval to code execution, removing opportunities for inspection and increasing the blast radius of any compromise. In a skill aimed at developers and automation workflows, such guidance normalizes unsafe command chaining and can lead to full host compromise if abused.- Content
bash # macOS / Linux (recommended) curl -fsSL https://cli.kiro.dev/install | bash # Or download from https://kiro.dev/
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The README recommends disabling confirmation prompts specifically 'for automation without confirmation prompts' via
--trust-all-tools, but does not pair that advice with any safety constraints or warnings. Because this skill is designed to orchestrate autonomous coding agents in background sessions, removing confirmations materially increases the risk of destructive or unauthorized actions proceeding unnoticed.- Content
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The README recommends
curl -fsSL https://cli.kiro.dev/install | bash, which executes a remote script directly without prior inspection or integrity verification. If the download endpoint, transport chain, or upstream distribution is compromised, users could immediately run arbitrary attacker-controlled code on their machine.- Content
bash # macOS / Linux（推荐） curl -fsSL https://cli.kiro.dev/install | bash # 或从 https://kiro.dev/ 下载
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
The
| bashpattern is dangerous because it chains network retrieval directly into shell execution, eliminating the opportunity for human review and making compromise of the fetched content immediately exploitable. In a README for an automation-focused coding skill, this normalizes an unsafe practice for users who may already be delegating sensitive operations to agents.- Content
bash # macOS / Linux（推荐） curl -fsSL https://cli.kiro.dev/install | bash # 或从 https://kiro.dev/ 下载
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
md ## Codex CLI **Default model:** `gpt-5.2-codex` (set in `~/.codex/config.toml`) ### Flags
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This section promotes
--full-autoand especially--yolomodes that permit autonomous code and shell actions, including unsandboxed execution, without requiring clear per-task user acknowledgement of repository and system side effects. In a skill that may auto-load, such defaults materially increase the risk of unintended file modification, command execution, and broader compromise from prompt-injected tasks.- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The examples normalize
--trust-all-tools, which disables confirmation barriers and allows unrestricted tool use by the coding agent. In practice this can enable arbitrary file writes, shell execution, or other tool actions in response to untrusted prompts or repository content.- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md A skill is a folder with a `SKILL.md` file:
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The workflow instructs autonomous agents to 'Commit and push' and then create PRs, introducing remote side effects on repositories without an explicit approval checkpoint. That is dangerous because delegated agents can publish incorrect, malicious, or sensitive changes to shared infrastructure or public remotes.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
gh pr create --repo user/repo --head fix/issue-78 --title "fix: ..." --body "..."
5. Clean up
git worktree remove /tmp/issue-78 git worktree remove /tmp/issue-99
text
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
5. Clean up
git worktree remove /tmp/issue-78 git worktree remove /tmp/issue-99
text ---
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Copy
SKILL.mdto your OpenClaw workspace skills directory:bash mkdir -p ~/.openclaw/workspace/skills/coding-agent cp SKILL.md ~/.openclaw/workspace/skills/coding-agent/
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README explicitly instructs users to run
kiro-cli chat --no-interactive --trust-all-tools, which grants the coding agent unrestricted tool access while suppressing user review. In the context of a coding-agent skill that can execute shell commands and modify files, this meaningfully increases the chance of unintended or unsafe file, system, or network actions from prompts or model mistakes.- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 91% confidence
- Finding
The phrase 'without confirmation prompts' signals intentional autonomous operation without human approval checkpoints. In a coding-agent integration, this can let the agent independently decide to edit files, run commands, or access resources based on imperfect model judgment or adversarial input.
- Content
md ## Important Notes 1. **Always use `pty:true`** — Coding agents need a pseudo-terminal 2. **Use `--trust-all-tools`** — For automation without confirmation prompts 3. **Use `--no-interactive`** — For simple one-shot queries 4. **Set `workdir`** — Keep agents focused on specific projects
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The README describes an assistant that can execute shell commands, browse the web, and manage files, but it does not pair these capabilities with meaningful warnings about system modification, credential exposure, or accidental data loss. In a skill that bridges chat platforms to coding agents, users may underestimate that a remote message can trigger impactful local actions.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
将
SKILL.md复制到 OpenClaw 工作区的 skills 目录：bash mkdir -p ~/.openclaw/workspace/skills/coding-agent cp SKILL.md ~/.openclaw/workspace/skills/coding-agent/
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
将
SKILL.md复制到 OpenClaw 工作区的 skills 目录:bash mkdir -p ~/.openclaw/workspace/skills/coding-agent cp SKILL.md ~/.openclaw/workspace/skills/coding-agent/
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README explicitly instructs users to run the coding agent with
--trust-all-tools, which removes interactive approval for tool use by the agent. In the context of a skill designed to let an AI coding assistant run background processes and modify projects, this materially increases the chance of unintended command execution, file changes, network access, or other destructive actions without user review.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The description is broad enough to match many generic coding requests, causing the skill to auto-activate in contexts where high-risk behaviors in the body may be inappropriately suggested. Because the skill contains guidance for autonomous execution, broad activation increases the chance those behaviors are applied unexpectedly.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Quick Start: One-Shot Tasks
bash # Codex needs a git repo — create a temp one for scratch work SCRATCH=$(mktemp -d) && cd $SCRATCH && git init && codex exec "Your prompt" # Run inside an existing project (with PTY)
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 89% confidence
- Finding
Auto-approve modes are a genuine risk in this context because they allow the delegated coding agent to act without human review within the workspace. Combined with broad triggering and other high-trust examples, this meaningfully increases exposure to unintended modifications.
- Content
md | Flag | Effect | | --------------- | -------------------------------------------------- | | `exec "prompt"` | One-shot execution, exits when done | | `--full-auto` | Sandboxed, auto-approves within workspace | | `--yolo` | No sandbox, no approvals (fastest, most dangerous) | ### Building / Creating
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Advertising a 'no approvals' mode lowers safeguards around autonomous execution and can cause an orchestrator to choose unsafe defaults. In context, this is risky because the skill is about launching powerful coding agents that may execute shell commands and modify repositories.
- Content
md | --------------- | -------------------------------------------------- | | `exec "prompt"` | One-shot execution, exits when done | | `--full-auto` | Sandboxed, auto-approves within workspace | | `--yolo` | No sandbox, no approvals (fastest, most dangerous) | ### Building / Creating
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 91% confidence
- Finding
The one-shot build example explicitly uses auto-approve, normalizing unsupervised modifications as routine behavior. For an auto-loadable skill, that encourages unsafe execution patterns even when the user did not request autonomous changes.
- Content
Building / Creating
bash # One-shot with auto-approve bash pty:true workdir:~/project command:"codex exec --full-auto 'Build a dark mode toggle'" # Background for longer work
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 92% confidence
- Finding
The 'no confirmation prompts' example encourages bypassing interactive safety checks for tool use. That increases the chance an autonomous session performs unintended actions from user input, repository instructions, or model error.
- Content
md # Single response kiro-cli chat --no-interactive "Show current directory" # Trust all tools (no confirmation prompts) kiro-cli chat --no-interactive --trust-all-tools "Create hello.py" # Trust specific tools only
Static analysis
No suspicious patterns detected.