Security audit
Security checks for vulnerabilities and agentic risk
This is a setup guide for using Kimi as a coding model backend, with expected third-party API and credential configuration but no hidden execution or destructive behavior.
Install only if you intend to route OpenClaw or Claude Code work through Kimi. Use a real key only in a local, untracked configuration or secure secret store, avoid pasting secrets into examples, and remember that prompts and code sent through this setup go to Kimi's external API.
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
claude
claude --print "Refactor this function to use async/await"
Claude Code auto-appends `/v1/messages` to the base URL. No other changes needed.
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
claude
claude --print "把这个函数改成 async/await"
Claude Code 会自动在 Base URL 后拼 `/v1/messages`，无需其他改动。
The skill instructs users to place API credentials directly into shell environment variables and spawned session environments without any warning about process visibility, shell history, config persistence, or downstream leakage into child processes/logs. In this context the skill is an integration guide, so credential use is expected, but the absence of safer handling guidance creates a real secret-exposure risk.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
{
"id": "kimi",
"type": "anthropic", // Kimi 用的是 Anthropic 协议
"baseUrl": "https://api.kimi.com/coding",
"apiKey": "sk-kimi-..."
}
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
{
"id": "kimi",
"type": "anthropic", // Kimi 用的是 Anthropic 协议
"baseUrl": "https://api.kimi.com/coding",
"apiKey": "sk-kimi-..."
}
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
{
"id": "kimi",
"type": "anthropic", // Kimi 用的是 Anthropic 协议
"baseUrl": "https://api.kimi.com/coding",
"apiKey": "sk-kimi-..."
}
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
{
"id": "kimi",
"type": "anthropic", // Kimi 用的是 Anthropic 协议
"baseUrl": "https://api.kimi.com/coding",
"apiKey": "sk-kimi-..."
}
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
{
"id": "kimi",
"type": "anthropic", // Kimi 用的是 Anthropic 协议
"baseUrl": "https://api.kimi.com/coding",
"apiKey": "sk-kimi-..."
}
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
{
"id": "kimi",
"type": "anthropic", // Kimi 用的是 Anthropic 协议
"baseUrl": "https://api.kimi.com/coding",
"apiKey": "sk-kimi-..."
}
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
{
"id": "kimi",
"type": "anthropic", // Kimi 用的是 Anthropic 协议
"baseUrl": "https://api.kimi.com/coding",
"apiKey": "sk-kimi-..."
}
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
{
"id": "kimi",
"type": "anthropic", // Kimi 用的是 Anthropic 协议
"baseUrl": "https://api.kimi.com/coding",
"apiKey": "sk-kimi-..."
}
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
{
"id": "kimi",
"type": "anthropic", // Kimi 用的是 Anthropic 协议
"baseUrl": "https://api.kimi.com/coding",
"apiKey": "sk-kimi-..."
}
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
{
"id": "kimi",
"type": "anthropic", // Kimi 用的是 Anthropic 协议
"baseUrl": "https://api.kimi.com/coding",
"apiKey": "sk-kimi-..."
}
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
{
"id": "kimi",
"type": "anthropic", // Kimi 用的是 Anthropic 协议
"baseUrl": "https://api.kimi.com/coding",
"apiKey": "sk-kimi-..."
}
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
{
"id": "kimi",
"type": "anthropic", // Kimi 用的是 Anthropic 协议
"baseUrl": "https://api.kimi.com/coding",
"apiKey": "sk-kimi-..."
}
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
{
"id": "kimi",
"type": "anthropic", // Kimi 用的是 Anthropic 协议
"baseUrl": "https://api.kimi.com/coding",
"apiKey": "sk-kimi-..."
}
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
{
"id": "kimi",
"type": "anthropic", // Kimi 用的是 Anthropic 协议
"baseUrl": "https://api.kimi.com/coding",
"apiKey": "sk-kimi-..."
}
The documentation instructs users to place API keys in environment variables and configuration files, but it does not warn that those secrets may be persisted in shell history, process environments, logs, screenshots, or committed config files. In a setup guide for a third-party model provider, omission of basic secret-handling guidance materially increases the chance of credential leakage.
The raw API examples send user-supplied prompts and potentially code or other content to a third-party endpoint, but the guide does not disclose that request contents leave the local environment. For a coding-model integration skill, that omission can lead users to unknowingly transmit proprietary code, credentials, or sensitive prompts to an external service.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s https://api.kimi.com/coding/v1/messages \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s https://api.kimi.com/coding/v1/messages \
No suspicious patterns detected.