Security audit
Security checks for vulnerabilities and agentic risk
This Kling AI skill is purpose-aligned: it uses a Kling API key to submit selected prompts/media, manage subjects, query quota, and download generated outputs.
Install only if you are comfortable sending prompts and selected media to Kling AI and using a Kling API key. Prefer session-only KLING_API_KEY if you do not want credentials stored on disk; if you use bind/import/configure, the API key is saved under the Kling storage root. Review subject delete commands carefully because deletion is explicit but not separately confirmed.
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
}
(function loadEnvFiles() {
const shellKeys = new Set(Object.keys(process.env));
try {
parseEnvContent(readFileSync(getDefaultKlingEnvPath(), 'utf-8'), { shellKeys });
} catch {}
The skill explicitly relies on environment-based secrets (KLING_API_KEY) and credential import flows, but the manifest does not declare an explicit tool/permission scope such as allowed access to environment variables. That creates a least-privilege and auditability gap: an agent may access sensitive env-backed credentials without a clear manifest-level declaration, increasing the risk of overbroad secret exposure or unsafe invocation in platforms that depend on declared scopes.
The skill supports persistent storage of API credentials and reusable subject/element data under a local storage root, including commands that import and write api_key into .credentials. Session persistence is not inherently malicious here, but storing long-lived credentials and user-generated subject data increases exposure if the host is multi-tenant, storage permissions are weak, or users are not clearly informed that state is retained across runs.
- Subject CRUD -> `element`
- Quota/balance/resource packs -> `account` (default `--costs`)
- Use existing subject in generation -> `video`/`image` + `--element_ids`
- Create subject first -> `element`
Force skill conditions (any hit -> use this skill):
- multi-image input (>=2 images)
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
console.log(`Kling AI subject management (create/query/list/delete)
Usage:
node kling.mjs element --action create [create options]
node kling.mjs element --action query --task_id <id>
node kling.mjs element --action list [--page_num 1] [--page_size 30]
node kling.mjs element --action list-presets [--page_num 1] [--page_size 30]
The delete action immediately issues a destructive API request using a user-supplied element ID, with no confirmation prompt, dry-run mode, or explicit warning at execution time. In an agent or CLI context, this increases the chance of accidental deletion from user typo, prompt confusion, or unintended automation, especially because the operation appears irreversible.
The code reads local image content and includes it in a payload sent via submitTask to the remote image generation API. While the script's purpose implies image generation, this code path does not provide a direct user-facing disclosure that local file contents and prompt text will be transmitted off-host.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
}
/**
* 写入 [profile] 下 api_key，并清除历史 AK/SK 键；Unix 上 chmod 600
* @param {string} profile
* @param {string} apiKey
* @param {Record<string,string>} [extra] 如 credentialId / accountId
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Multi-shot:
--multi_shot true / false. Request field only on kling-3.0 / kling-3.0-omni (official default true).
Base video edit: if omitted, CLI sends false (server default true would fail).
Turbo: write 镜头 n, m, words; in --prompt; do not pass --multi_shot.
Query/download:
--task_id Task ID
This code submits a payload to a remote service and then polls/downloads results, which can transmit user prompts, image inputs, and reference video URLs off-system. Although the script help documents usage and credentials, it does not explicitly warn users that their supplied content is sent to an external provider.
The script consistently presents bilingual output and includes Chinese-only phrasing such as '仅人物/类人形象', but it does not let the user select a preferred language or locale. This can violate language/locale policy when a skill forces a specific presentation format without user opt-in.
The script consistently mixes English and Chinese in error and help messages, which reflects a fixed language presentation chosen by the skill author rather than by the user. Under the stated policy, language behavior should either offer user choice or document a justified locale constraint.
The function downloads remote files and writes them into the output directory, but this path does not itself emit a user-facing notice before writing files. Although writing output is related to the tool's purpose, the specific file-write behavior lacks an explicit warning or confirmation in this execution path.
The error messages are hard-coded as bilingual "Error / 错误" strings, which imposes a specific locale/language presentation without any user opt-in or configuration. This matches the policy category for language or locale constraints that are not user-selectable.
This code emits fixed bilingual Chinese/English status and error messages to users, such as endpoint probing and troubleshooting text, without offering a language choice or documenting a locale requirement. That can violate language/locale policy when a skill imposes a specific locale on all users rather than letting them opt in.
The file contains user-facing and instructional natural language in bilingual English/Chinese form, including comments and console messages such as task submission, waiting, download, and parameter descriptions. This imposes a specific locale choice without any indication that the skill is region-specific or that users can opt into their preferred language, which can conflict with organizational language-choice policies.
User-facing errors and help text consistently embed Chinese alongside English, including command guidance and validation messages. This imposes a specific locale/language presentation without any opt-in, choice, or documented justification for the locale behavior.
The help text indicates the skill reads an API key from a credentials file or environment variable, and the main flow obtains that token for remote API access. However, there is no explicit warning that the skill authenticates to a third-party service using locally stored credentials, which is relevant user disclosure for privacy and account-impact awareness.
Detected: suspicious.exposed_secret_literal