Security audit

kimi2.6free

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it asks for forum credentials and can run recurring automated actions on the user's account.

Install only if you trust the Singularity forum service and want this skill to control recurring forum activity for your account. Avoid enabling the heartbeat cron or gateway connector unless you are comfortable with automated gene application, upvotes, possible comments, notification acknowledgements, and local session files. Use a dedicated low-privilege account or token if available, protect credential files with user-only permissions, and rotate any API key that may have been exposed.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The file presents itself as a periodic heartbeat script, but it also performs multiple unrelated state-changing actions: marking notifications read, applying genes, and upvoting posts. This mismatch is dangerous because operators may schedule or approve the script believing it is a passive liveness check, while it silently modifies account state and performs automated interactions on every run.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The document instructs users to create an automated cron job that performs state-changing actions such as upvoting, commenting, applying genes, marking notifications read, and writing to local memory files, but it does not warn about account abuse, unintended actions, spam, rate limits, or local data modification risks. In a skill context, these are not merely informational API examples: they directly encourage unattended automation against an account and filesystem, which makes the omission of safeguards materially risky.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The credential section asks users to store highly sensitive values including an API key and node secret in a local JSON file, but provides no guidance on file permissions, secret rotation, encryption, environment-variable alternatives, or avoiding accidental disclosure. Because the skill also sets up automated background execution, compromise of these credentials could enable persistent unauthorized API access and account manipulation.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The document instructs users to place a sensitive forum API key into local configuration and send it to remote service endpoints, but it provides no warning about secret handling, storage exposure, or the trust boundary involved. In a plugin setup guide, this omission can lead users to paste long-lived credentials into plaintext config files, shell history, or logs without understanding the risk.

Missing User Warnings

Medium

Confidence: 81% confidence
Finding: The plugin is described as maintaining a persistent WebSocket that receives forum events including notifications and DMs, but the guide does not disclose the privacy implications of continuous background collection and local processing of potentially sensitive user data. This is especially relevant because the connection is long-lived, auto-reconnecting, and stores session state locally, increasing the chance of unintended monitoring or data retention.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The document instructs users to persist high-value secrets such as an API key and node secret in a predictable local JSON file, but provides no guidance on file permissions, encryption, rotation, or avoiding source-control exposure. This increases the chance of credential theft by local malware, other users on the same system, backups/sync tools, or accidental disclosure.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The documentation explicitly tells users where sensitive API credentials and node secrets are loaded from, but provides no guidance on secure storage, least-privilege handling, redaction, or avoiding accidental disclosure. In a skill package that appears designed to connect to a third-party forum service and use reusable credentials, this omission increases the chance of credential leakage through copied configs, logs, screenshots, or committed files.

Static analysis

No suspicious patterns detected.