ClawHub
Back to skill

Security audit

Kmi

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Belgian weather CLI helper, with the main caveat that its external CLI install sources are not pinned or checksum-verified.

Before installing, consider whether you trust the dedene kmi CLI distribution channel. Prefer a specific reviewed release with checksum or signature verification if available, and be aware that radar commands write image files while favorites store user-chosen locations.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:17
Finding

Unpinned Third-Party Installation Artifacts

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17-26 and 181-188
Vulnerability Type: Supply-chain risk from mutable, unverified dependencies
Risk Level: Medium

Vulnerable Code

Lines 17-26:

yaml
    - kind: brew
      tap: dedene/tap
      formula: kmi
      bins: [kmi]
    - kind: go
      package: github.com/dedene/kmi-irm-cli/cmd/kmi
      bins: [kmi]
    - kind: binary
      url: https://github.com/dedene/kmi-irm-cli/releases/latest
      bins: [kmi]

Lines 181-188:

bash
# macOS/Linux
brew install dedene/tap/kmi

# Windows - download from GitHub Releases
# https://github.com/dedene/kmi-irm-cli/releases

Technical Analysis

The Skill defines installation methods that rely on mutable third-party sources without pinning an audited version, commit, artifact digest, or cryptographic signature. In particular:

  • The Go package does not specify a module version or immutable commit.
  • The binary source references the mutable releases/latest endpoint.
  • The custom Homebrew tap can update its formula and downloaded artifacts after this Skill has been reviewed.
  • No SHA-256 checksum, signature, provenance attestation, or verification procedure is provided.

Consequently, the code eventually installed under the trusted kmi command name can differ from the code that existed when the Skill was audited. This creates a supply-chain boundary in which compromise of the upstream repository, release credentials, GitHub account, Homebrew tap, or artifact hosting process could introduce attacker-controlled executable code.

Attack Path

  1. An attacker compromises an upstream publishing account, repository, release workflow, Homebrew tap, or associated artifact.
  2. The attacker publishes a modified release, Go source revision, or Homebrew formula under the expected project identity.
  3. A user or Agent follows the installation metadata or documented installa ...[truncated 1096 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the CLI to a specific audited semantic version and, where possible, an immutable source commit.
  2. Replace the mutable releases/latest URL with a version-specific direct artifact URL.
  3. Publish SHA-256 checksums for every platform artifact and require checksum verification before installation or execution.
  4. Sign release artifacts and document signature verification using a trusted mechanism such as Sigstore or GPG.
  5. Pin the Go installation to an explicit version, for example github.com/dedene/kmi-irm-cli/cmd/kmi@vX.Y.Z.
  6. Pin or otherwise verify the Homebrew formula and the artifact digest it installs.
  7. Use protected release workflows, least-privilege publishing credentials, branch protection, and provenance attestations.
  8. Update the Skill only after reviewing each new pinned release rather than automatically following mutable upstream content.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep