Security audit

minimax2.7free

Security checks for vulnerabilities and agentic risk

Overview

This skill is mainly for accessing a forum-based Kimi model service, but it also sets up credential-backed automation that can change your forum account and run repeatedly without clear per-action consent.

Review before installing. Use this only with a dedicated, low-privilege forum account or token if possible. Do not enable the heartbeat cron or OpenClaw connector unless you are comfortable with automated upvotes, comments, gene application, notification acknowledgements, recurring network calls, and local state files. Protect credential files with user-only permissions and rotate any exposed API key or node secret.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: This module exposes a wide set of authenticated account actions, including reading account data, mutating notifications, applying genes, posting comments, upvoting content, exchanging cards, and sending heartbeats, while providing no visible permission checks, scope restrictions, or purpose limitation in the entrypoint. In an agent-skill context, such broad action surface increases the chance of unauthorized or unintended account activity if the skill is invoked with stored credentials or by higher-level automation without strong user consent boundaries.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The file is presented as a periodic 'heartbeat' script, but it also performs unrelated state-changing actions such as marking notifications read, applying genes, and upvoting posts. This mismatch can mislead operators into running automation that mutates account state and social activity without realizing the full scope, increasing the risk of unauthorized or unexpected actions.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The document instructs users to schedule automated actions that modify remote account state (upvotes, comments, gene application, heartbeat activity) and local state (writing memory files) without prominently warning that these are side-effecting operations. In an agent skill context, this is risky because users may treat the setup as passive maintenance, while it actually performs autonomous engagement and content actions that can affect account reputation, policy compliance, and local data integrity.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The credentials section asks users to store sensitive secrets such as apiKey and nodeSecret in a local JSON file, but provides no guidance on file permissions, secret rotation, least privilege, or avoiding accidental disclosure. In a skill/setup document, this increases the chance that high-value credentials are stored insecurely, committed to source control, or reused broadly, enabling account takeover or unauthorized API access if exposed.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The guide instructs users to embed a long-lived forum API key directly into local configuration and transmit it to remote service endpoints, but provides no guidance on secret handling, file permissions, rotation, redaction, or use of a safer secret store. In a plugin setup guide, this omission materially increases the risk of accidental credential disclosure through shell history, config file exposure, backups, logs, screenshots, or shared workspaces.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The document instructs users to persist highly sensitive credentials locally, including an API key and node secret, but provides no guidance on file permissions, encryption, secret rotation, or avoiding accidental exposure through backups, sync tools, and version control. This increases the likelihood of credential theft or misuse if the local system is multi-user, compromised, or the file is unintentionally shared.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill explicitly documents loading sensitive credentials from environment variables and local credential files but provides no warning about secret sensitivity, storage risks, or least-privilege handling. That omission increases the chance that users expose API keys or node secrets through insecure local storage, accidental sharing, or unsafe filesystem permissions.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The skill directly exposes credential loading via getCredentials and also implicitly loads credentials for every exported API action, but there is no user-facing disclosure, consent flow, or indication of how secrets are stored and used. In a security-sensitive agent environment, silent credential access is dangerous because it normalizes hidden secret use and makes it easier for downstream code to retrieve or misuse account credentials.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The module automatically attaches a bearer API key to every outbound request to a third-party domain, but the file provides no safeguards, minimization, or disclosure around credential transmission. In an agent-skill context, this is more dangerous because seemingly harmless read or action calls can silently exfiltrate a reusable secret off-platform, and users or orchestrators may not realize the skill is sending credentials externally.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The script automatically performs account mutations and social actions, including marking notifications read, applying genes, sending heartbeats, and upvoting posts, without interactive confirmation or a clear opt-in for each action. In an agent skill context, this is dangerous because a routine or scheduled execution can silently alter account state, generate engagement, and trigger irreversible platform-side effects.

Static analysis

No suspicious patterns detected.