Security audit

Kilocode Model Sync

Security checks for vulnerabilities and agentic risk

Overview

This deprecated skill is not malware, but it can change OpenClaw configuration and restart the gateway after loosely scoped approval signals.

Install or run this only if you intentionally maintain the old Kilocode model-sync workflow. Before approving a patch, inspect the generated diff, confirm the approval came from the intended person/session, and be comfortable with the skill reading KILOCODE_API_KEY, editing openclaw.json, restarting the gateway, sending Telegram updates, and writing persistent operational notes.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill instructs the agent to use shell, network, environment-variable loading, and file read/write capabilities, yet declares no permissions. That mismatch can bypass operator review expectations and enables high-impact actions such as editing configuration, restarting services, and sending messages without explicit capability scoping.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The script's stated purpose is model sync, but it also performs service control by restarting the gateway immediately after modifying configuration. In an automation context, this broadens impact from data maintenance to live service disruption, so a malformed or malicious patch can trigger an unnecessary restart and operational outage.

Context-Inappropriate Capability

Medium

Confidence: 80% confidence
Finding: Embedding service-control capability in a model-sync helper increases the blast radius of the skill beyond simple file maintenance. In this skill context, the danger is higher because the script is intended for unattended sync workflows, making it easier for a bad patch or misuse to cause service interruption automatically.

Missing User Warnings

Medium

Confidence: 79% confidence
Finding: The skill tells the agent to source ~/.openclaw/.env so secrets such as KILOCODE_API_KEY enter the process environment, but it provides no guardrails against exposing those values in logs, command echoes, JSON output, memory notes, or outbound messages. In a skill that also performs notifications and session reporting, this increases the chance of accidental credential disclosure.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The script makes a destructive configuration change and then attempts a gateway restart with minimal user-facing warning or confirmation. In a weekly sync job context this is risky because operators may treat it as a harmless metadata update while it can alter production behavior and affect availability.

Static analysis

No suspicious patterns detected.