ClawHub
Back to skill

Security audit

Kimi Integration

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Kimi setup guide, but it includes unsafe API-key handling that could expose a user’s credentials.

Review before installing. The skill appears to do what it claims, but avoid printing API keys, avoid putting real keys directly in shared config files, use a restricted secret file or secret manager, and rotate any key that may have been displayed in logs, screenshots, or support transcripts. Run the API test script only when you are comfortable sending a test prompt and bearer token to the Moonshot/Kimi endpoints.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
README.md:148
Finding

Full API Keys Exposed Through Troubleshooting Commands

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
references/config-examples.md:220
Finding

Documentation Encourages Persistent Plaintext API-Key Storage

Content
View full analysis
> ~/.env ``` Related instructions in `SKILL.md:150`: ```bash echo 'KIMICODE_API_KEY="sk-your-kimicode-key-here"' >> ~/.env ``` ### Technical Analysis The configuration example demonstrates storing reusable API keys directly in the main Clawdbot configuration. The setup instructions also append credentials to `~/.env` without first creating the file with restrictive permissions or verifying its existing ownership and access mode. Plaintext secrets in ordinary configuration files can be exposed through: - Accidental source-control commits. - Configuration backups or synchronization services. - Support bundles and diagnostic collection. - Overly permissive filesystem permissions. - Access by other local users or processes running under the same account. - Unintended disclosure when configuration is displayed for troubleshooting. The documentation acknowledges that direct configuration storage is less secure, but it still provides a ready-to-copy pattern and does not prescribe mandatory file-permission controls for the `.env` alternative. ### Attack Path 1. A user copies the direct-configuration example or appends valid credentials to an existing `~/.env`. 2. The resulting file remains plaintext and may have permissions broader than necessary. 3. The file is committed, backed up, synchronized, included in diagnostics, or read by another local process or user. 4. An unauthorized party extracts the API ...[truncated 686 chars]
Remediation
View remediation
> ~/.config/clawdbot/secrets.env printf '%s\n' 'KIMICODE_API_KEY="replace-with-key"' >> ~/.config/clawdbot/secrets.env ``` - Verify that the secret file is owned by the intended user and is not readable by group or other users. - Add credential-bearing files to `.gitignore` and explicitly warn users never to commit them. - Ensure configuration inspection and diagnostic commands redact environment values. - Document key rotation and revocation procedures for suspected exposure. - Keep provider configuration limited to variable references such as `${MOONSHOT_API_KEY}` rather than literal credentials. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (36)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The declared purpose is a setup guide, but the content also directs users to validate secrets, print environment variables, and perform live network connectivity tests against external APIs. That mismatch matters because an agent may invoke the skill in a low-risk help context while actually causing secret handling and outbound transmission behaviors the user did not explicitly authorize.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
84% confidence
Finding

The guide instructs users to append a live API key directly into a dotfile using shell redirection. Although common in developer workflows, this encourages long-lived secret persistence in plaintext and may expose credentials through backups, misconfigured permissions, shared accounts, or accidental publication.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

Or add to .env file:

bash
echo 'MOONSHOT_API_KEY="sk-your-moonshot-key-here"' >> ~/.env

Step 2: Add provider configuration

Credential Access

High
Category
Privilege Escalation
Confidence
84% confidence
Finding

This repeats the same unsafe secret persistence pattern for the Kimi Code key. Storing bearer credentials in plaintext dotfiles without guidance on permissions or secret management increases the chance of credential compromise.

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

Or add to .env:

bash
echo 'KIMICODE_API_KEY="sk-your-kimicode-key-here"' >> ~/.env

Step 2: Add provider configuration

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/config-examples.md (reported line 194)May include surrounding context.

md
## Environment Variables Setup

### Using .env file

Create or edit `~/.env`:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 163)May include surrounding context.

Test endpoint directly:

bash
curl -X POST "https://api.moonshot.cn/v1/chat/completions" \
  -H "Authorization: Bearer $MOONSHOT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "kimi-k2.5", "messages": [{"role": "user", "content": "test"}]}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/config-examples.md (reported line 263)May include surrounding context.

Test endpoint directly:

bash
curl -X POST "https://api.moonshot.cn/v1/chat/completions" \
  -H "Authorization: Bearer $MOONSHOT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "kimi-k2.5", "messages": [{"role": "user", "content": "test"}]}'

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
83% confidence
Finding

The skill includes shell commands and operational steps but does not declare any tool scope or allowed-tools restrictions. In an agent ecosystem, this increases the chance that a model or orchestrator will treat the skill as documentation while still enabling command execution, creating an unnecessary pathway for unintended shell actions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md
1. Visit https://platform.moonshot.cn
2. Register an account
3. Navigate to API Keys section
4. Create a new API key
5. Copy the key (starts with `sk-...`)

### Kimi Code

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The troubleshooting steps recommend echoing API keys directly to the terminal, which can expose secrets through terminal history, screen sharing, logs, or shoulder-surfing. Even if intended for debugging, instructing users to print credentials is unsafe handling of secrets.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The guide recommends sending a real authenticated request to an external provider without warning that the API key and prompt content are being transmitted off-system. In agent-assisted environments, users may not realize that 'test' steps have privacy, billing, and data-governance consequences.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This duplicate finding refers to the same authenticated curl example that transmits a bearer token and prompt content externally. The danger is contextual: the test step is operational, not merely descriptive, and lacks adequate warning about data egress and secret use.

Content

Scanner excerpt · SKILL.md (reported line 292)May include surrounding context.

Test API endpoint directly:

bash
curl -X POST "https://api.moonshot.cn/v1/chat/completions" \
  -H "Authorization: Bearer $MOONSHOT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "kimi-k2.5", "messages": [{"role": "user", "content": "test"}]}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This duplicate finding refers to the same authenticated curl example that transmits a bearer token and prompt content externally. The danger is contextual: the test step is operational, not merely descriptive, and lacks adequate warning about data egress and secret use.

Content

Scanner excerpt · SKILL.md (reported line 292)May include surrounding context.

Test API endpoint directly:

bash
curl -X POST "https://api.moonshot.cn/v1/chat/completions" \
  -H "Authorization: Bearer $MOONSHOT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "kimi-k2.5", "messages": [{"role": "user", "content": "test"}]}'

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/config-examples.md (reported line 196)May include surrounding context.

Using .env file

Create or edit ~/.env:

bash
# Moonshot AI (Kimi K2.5)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The documentation tells users to persist API keys in shell startup files, which can increase credential exposure through dotfile syncing, backups, shell history during editing, or accidental sharing of home-directory configuration. While common in developer docs, it lacks guidance on safer secret storage and file-permission hygiene, so it is a legitimate security weakness in the instructions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This example shows API keys embedded directly in application configuration, which creates a clear risk of credential leakage via source control, shared config files, logs, backups, screenshots, or support bundles. Although the note says this is 'less secure,' it does not clearly warn against accidental exposure in shared or committed configs, so the finding is valid.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 53)May include surrounding context.

md
# Test Moonshot API
  echo "  Testing Moonshot API..."
  response=$(curl -s -X POST "https://api.moonshot.cn/v1/chat/completions" \
    -H "Authorization: Bearer $MOONSHOT_API_KEY" \
    -H "Content-Type: application/json" \
    -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 163)May include surrounding context.

md
# Test Moonshot API
  echo "  Testing Moonshot API..."
  response=$(curl -s -X POST "https://api.moonshot.cn/v1/chat/completions" \
    -H "Authorization: Bearer $MOONSHOT_API_KEY" \
    -H "Content-Type: application/json" \
    -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

md
# Test Moonshot API
  echo "  Testing Moonshot API..."
  response=$(curl -s -X POST "https://api.moonshot.cn/v1/chat/completions" \
    -H "Authorization: Bearer $MOONSHOT_API_KEY" \
    -H "Content-Type: application/json" \
    -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 243)May include surrounding context.

md
# Test Moonshot API
  echo "  Testing Moonshot API..."
  response=$(curl -s -X POST "https://api.moonshot.cn/v1/chat/completions" \
    -H "Authorization: Bearer $MOONSHOT_API_KEY" \
    -H "Content-Type: application/json" \
    -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/config-examples.md (reported line 13)May include surrounding context.

md
# Test Moonshot API
  echo "  Testing Moonshot API..."
  response=$(curl -s -X POST "https://api.moonshot.cn/v1/chat/completions" \
    -H "Authorization: Bearer $MOONSHOT_API_KEY" \
    -H "Content-Type: application/json" \
    -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/config-examples.md (reported line 33)May include surrounding context.

md
# Test Moonshot API
  echo "  Testing Moonshot API..."
  response=$(curl -s -X POST "https://api.moonshot.cn/v1/chat/completions" \
    -H "Authorization: Bearer $MOONSHOT_API_KEY" \
    -H "Content-Type: application/json" \
    -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/config-examples.md (reported line 172)May include surrounding context.

md
# Test Moonshot API
  echo "  Testing Moonshot API..."
  response=$(curl -s -X POST "https://api.moonshot.cn/v1/chat/completions" \
    -H "Authorization: Bearer $MOONSHOT_API_KEY" \
    -H "Content-Type: application/json" \
    -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/config-examples.md (reported line 232)May include surrounding context.

md
# Test Moonshot API
  echo "  Testing Moonshot API..."
  response=$(curl -s -X POST "https://api.moonshot.cn/v1/chat/completions" \
    -H "Authorization: Bearer $MOONSHOT_API_KEY" \
    -H "Content-Type: application/json" \
    -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/config-examples.md (reported line 263)May include surrounding context.

md
# Test Moonshot API
  echo "  Testing Moonshot API..."
  response=$(curl -s -X POST "https://api.moonshot.cn/v1/chat/completions" \
    -H "Authorization: Bearer $MOONSHOT_API_KEY" \
    -H "Content-Type: application/json" \
    -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/test_kimi_connection.sh (reported line 24)May include surrounding context.

sh
# Test Moonshot API
  echo "  Testing Moonshot API..."
  response=$(curl -s -X POST "https://api.moonshot.cn/v1/chat/completions" \
    -H "Authorization: Bearer $MOONSHOT_API_KEY" \
    -H "Content-Type: application/json" \
    -d '{

Static analysis

No suspicious patterns detected.