Kimi Code Quota

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:27 AM UTC
• Version: 1.0.0

Overview

This skill does what it says, but it reaches into an authenticated account console and can leave sensitive quota and API-key metadata in a saved screenshot without clear consent or cleanup.

Review before installing. Use this only when you intentionally want an agent to open your Kimi Code console, and avoid using it in shared workspaces unless the screenshot behavior is removed or changed to temporary redacted storage. The safer version would require a Kimi-specific trigger, explicit consent before console/API-key inspection, quota-only reporting by default, and no saved screenshot unless requested.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:40

Finding

Persistent Screenshot May Expose Sensitive Account and API-Key Metadata

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 40-43
Vulnerability Type: Predictable, persistent storage of sensitive dashboard information
Risk Level: Medium

Complete Code Snippet

bash

agent-browser snapshot -i
agent-browser screenshot quota.png

Technical Analysis

The skill instructs the agent to capture the authenticated Kimi Code console in a screenshot and save it under the fixed filename quota.png. The same workflow directs the agent to inspect API-key metadata, including API ID, name, creation time, partially hidden key material, and status.

Persisting this dashboard image is unnecessary for producing the requested quota summary. The instructions do not require user consent for storage, restrictive file permissions, redaction of sensitive fields, a securely generated temporary filename, or deletion after processing. The predictable filename may also overwrite an existing file.

The issue does not expose full API keys based on the documented workflow, and no transmission of the screenshot to an external party is specified.

Attack Path

1. A user invokes the skill while authenticated to Kimi Code.
2. The agent opens the account console containing quota, subscription, and API-key metadata.
3. The agent saves the visible console as quota.png in its current working directory.
4. The file remains after the quota report is generated because no cleanup step is defined.
5. Another user or process with access to that directory reads the retained screenshot and obtains the displayed account metadata.

Impact Assessment

Exploitation requires local read access to the directory where the screenshot is stored. A successful exploit may disclose subscription details, usage and reset information, membership level, API-key names and identifiers, creation dates, status, and any partially masked key material visible on the page.

This does not directly grant elevated privileges o ...[truncated 193 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the screenshot command and extract only the minimum required values from the page snapshot or DOM.
2. If visual capture is necessary, obtain explicit user consent before saving account information.
3. Redact API-key metadata and unrelated account details before persistence.
4. Use an operating-system-generated temporary file with a unique name and owner-only permissions rather than the predictable quota.png path.
5. Delete the temporary image immediately after extracting the required information, including cleanup during errors or cancellation.
6. Avoid reporting partially masked key material unless the user explicitly requests it; return only the key name and status by default.
7. Prevent unintended overwrite by using exclusive file creation if a persistent artifact is explicitly requested.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly instructs the agent to read and report API key details, including partially hidden key values and recent usage records, from the user's console. Even partially masked secrets and usage metadata are sensitive; exposing them in outputs, screenshots, or logs increases the risk of credential disclosure, account reconnaissance, and downstream compromise if transcripts or artifacts are retained.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger keyword "quota" is overly broad and can match many unrelated requests, causing the skill to activate outside the intended Kimi Code context. Unintended activation is risky here because the skill opens an authenticated account page and may inspect sensitive subscription and API key information without sufficiently specific user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill does not clearly warn users that it will access their authenticated console and read API key metadata and possibly usage information. Without an explicit notice and consent step, users may request a quota check without realizing the agent will traverse sensitive account pages and expose security-relevant details in the chat.

Content

No source excerpt is available for this finding.