Security audit

Kilocode Model Sync

Security checks for vulnerabilities and agentic risk

Overview

This deprecated sync skill is not clearly malicious, but it should be reviewed because it can rewrite OpenClaw gateway configuration from weakly validated patch files, restart the gateway, and send operational details to a hardcoded Telegram chat.

Install only if you understand this is a deprecated operational skill and still need it. Before running it, restrict who can create or modify patch files, verify the exact patch contents and source, avoid broad .env sourcing where possible, confirm Telegram is an approved destination for operational details, and keep backups so OpenClaw configuration can be restored if the gateway fails after a patch.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/apply_patch.py:75
Finding: Unauthenticated Patch File Can Modify Active Gateway Configuration
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Rogue AgentSelf-Modification, Session Persistence
Behavioral ASTexec() Call, eval() Call, Dynamic Import
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (16)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description says this skill syncs models from a live API and reports results, but the body also includes patch application, config replacement, gateway restart, and status polling. This mismatch can cause operators or orchestrators to trust the skill as low-risk synchronization logic when it actually performs privileged configuration changes and service-affecting actions.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 97% confidence
Finding: The skill explicitly sources ~/.openclaw/.env, which exposes all environment variables in that file to the shell process and any subprocesses. Broadly loading credentials is risky because the called script or later commands may access or leak secrets beyond the single API key actually needed, and the skill has additional network and messaging behaviors that increase exfiltration risk.
Content: Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.
Step 1 — Run the sync script

bash
source ~/.openclaw/.env && python3 ~/.openclaw/workspace/skills/kilocode-model-sync/scripts/sync_models.py

Parse the JSON result from stdout. It contains:

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/sync_models.py (reported line 25)May include surrounding context.
python
# ── Config ──────────────────────────────────────────────────────────────────── API_URL = "https://api.kilo.ai/api/gateway/models" ENV_FILE = Path.home() / ".openclaw" / ".env" OPENCLAW_JSON = Path.home() / ".openclaw" / "openclaw.json" DEFAULT_OUT = Path.home() / ".openclaw" / "workspace" / "kilocode-models"

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/sync_models.py (reported line 139)May include surrounding context.
python
# ── Config ──────────────────────────────────────────────────────────────────── API_URL = "https://api.kilo.ai/api/gateway/models" ENV_FILE = Path.home() / ".openclaw" / ".env" OPENCLAW_JSON = Path.home() / ".openclaw" / "openclaw.json" DEFAULT_OUT = Path.home() / ".openclaw" / "workspace" / "kilocode-models"

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill requests capabilities that include environment access, file reads/writes, network use, and shell execution, but it does not declare any explicit tool restrictions. In a skill that can edit configuration, source credentials from a .env file, message external parties, and restart infrastructure, the absence of scoped permissions increases the blast radius if the skill is invoked or modified unexpectedly.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The header states the skill is deprecated and should not be run, yet the remainder provides detailed execution instructions, including patching configuration and restarting a gateway. Contradictory guidance is dangerous because an agent or operator may still follow the actionable steps, defeating the warning and increasing the chance of unintended execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill instructs sending operational details, including model inventory changes and infrastructure state, to Telegram without an explicit privacy or approval warning. External messaging can leak internal configuration, deployment timing, model identifiers, backup paths, or failure details to a third-party channel not appropriate for sensitive operational data.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 81% confidence
Finding: The skill writes a persistent memory note even when no changes occur. Persistent logging of operational activity is not always unsafe, but it can accumulate sensitive metadata such as dates, model counts, and execution history that may be unnecessary and could later aid reconnaissance.
Content: Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.
Step 2 — If status == "no_change"

Write a brief memory note and stop. No notification needed.

text
# memory/YYYY-MM-DD.md entry:

Session Persistence

Medium

Category: Rogue Agent
Confidence: 87% confidence
Finding: The skill appends detailed mission-control entries containing added/removed/updated model IDs, backup paths, restart outcomes, and approval metadata to persistent memory. This creates a durable record of internal configuration changes and file locations that could expose sensitive operational context if the memory store is broadly accessible.
Content: Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.
md
--- ## Step 6 — Write mission control entry Append to `~/.openclaw/workspace/memory/YYYY-MM-DD.md`:

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/apply_patch.py (reported line 60)May include surrounding context.
python
def restart_gateway(openclaw: str) -> dict: """Restart the OpenClaw gateway and wait for it to come back up.""" # Send restart result = subprocess.run( [openclaw, "gateway", "restart"], capture_output=True, text=True, timeout=30 )

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/apply_patch.py (reported line 70)May include surrounding context.
python
# Wait for gateway to come back (poll up to 30s) for attempt in range(10): time.sleep(3) probe = subprocess.run( [openclaw, "gateway", "status"], capture_output=True, text=True, timeout=10 )

Tainted flow: 'patch' from pathlib.Path.read_text (line 92, file read) → pathlib.Path.write_text (file write)

Medium

Category: Data Flow
Confidence: 65% confidence
Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
Content: Scanner excerpt · scripts/apply_patch.py (reported line 133)May include surrounding context.
python
# 5. Mark patch as applied patch["applied"] = True patch["applied_at"] = datetime.now(timezone.utc).isoformat() patch_path.write_text(json.dumps(patch, indent=2)) # 6. Restart gateway try:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/sync_models.py (reported line 24)May include surrounding context.
python
from urllib.error import URLError, HTTPError # ── Config ──────────────────────────────────────────────────────────────────── API_URL = "https://api.kilo.ai/api/gateway/models" ENV_FILE = Path.home() / ".openclaw" / ".env" OPENCLAW_JSON = Path.home() / ".openclaw" / "openclaw.json" DEFAULT_OUT = Path.home() / ".openclaw" / "workspace" / "kilocode-models"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This code loads KILOCODE_API_KEY from the environment or ~/.openclaw/.env and immediately uses it as a Bearer token in an outbound HTTP request. Although the module docstring describes fetching models, there is no explicit user-facing warning, prompt, or inline disclosure near the credential access and transmission.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The skill hardcodes Telegram as the communication mechanism and target, removing user choice over where operational data is sent. While not inherently malicious, forced external delivery increases the chance of policy violations or accidental disclosure when the environment expects internal-only communications.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The script creates and overwrites JSON artifacts under ~/.openclaw/workspace/kilocode-models, including the current day's snapshot and optional diff/patch files. While file output is part of the tool's purpose, the write operations themselves have no nearby confirmation or user-facing disclosure beyond the brief top-level usage text.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

SkillSpector

Tp4

Credential Access

Step 1 — Run the sync script

Credential Access

Credential Access

Undeclared Tool Scope

Intent-Code Divergence

Missing User Warnings

Session Persistence

Step 2 — If status == "no_change"

Session Persistence

subprocess module call

subprocess module call

Tainted flow: 'patch' from pathlib.Path.read_text (line 92, file read) → pathlib.Path.write_text (file write)

External Transmission

Missing User Warnings

Natural-Language Policy Violations

Missing User Warnings

Static analysis

Step 2 — If `status == "no_change"`