Security audit

Kairoa CLI

Security checks for vulnerabilities and agentic risk

Overview

This is a plausible developer toolbox skill, but it asks users to trust an unpinned external CLI for sensitive file, credential, network, and AI-provider operations.

Review this skill before installing. Use a pinned, verified kairoa release rather than curl-to-bash or releases/latest, avoid system-wide installation unless needed, and only run .env, vault, AI Chat, HTTP, and port-scan commands on data, providers, and targets you explicitly trust and authorize.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:42
Finding: Mutable Remote Installation Script Is Piped Directly into Bash
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, line 42
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

bash
curl -sSL https://raw.githubusercontent.com/covoyage/kairoa-cli/main/install.sh | bash

Technical Analysis

The installation command retrieves a shell script from the mutable main branch of an external GitHub repository and immediately executes it with Bash. The payload is not pinned to an immutable commit, downloaded for mandatory inspection, verified against a checksum, or authenticated with a release signature.

The surrounding documentation advises users to inspect the script and avoid running it as root, but the provided command itself does not enforce either control. Because retrieval and execution are connected by a pipe, the exact code executed can differ from the code reviewed when the Skill was published.

This behavior is not required for the declared developer-tool functionality. It is only an installation convenience and therefore exceeds the minimum risk necessary to provide the Skill.

Attack Path

An attacker compromises the upstream GitHub account, repository, maintainer credentials, or branch-protection process.

The attacker modifies install.sh on the main branch to contain malicious shell commands.

A user or Agent follows the installation command from SKILL.md.

curl retrieves the attacker-controlled script without version or integrity validation.

Bash immediately executes the response with the invoking user's privileges.

The payload can access user-readable files, modify user configuration, install additional executables, establish persistence where permitted, or transmit credentials over the network.

A network or upstream compromise affecting the returned content could produce the same result. Running the command with elevated privileges, despite the warning, would increase the impact t ...[truncated 772 chars]
Remediation: View remediation
Remediation Suggestions

Remove the direct curl | bash installation command.

Pin installation artifacts to an immutable, audited release version rather than the main branch.

Download scripts and binaries as separate files before execution.

Publish SHA-256 or stronger checksums through an authenticated release channel and require verification before installation.

Sign release artifacts with a verifiable signing mechanism, such as Sigstore or a maintained release-signing key.

Fail closed when checksum or signature verification fails.

Require explicit user confirmation before executing downloaded code.

Run installation with ordinary user privileges wherever possible and document precisely which installation step, if any, requires elevation.

Prefer a source build from a pinned commit after dependency verification.

A safer workflow would resemble:

bash
curl -fL -o install.sh https://raw.githubusercontent.com/covoyage/kairoa-cli/IMMUTABLE_COMMIT/install.sh echo "EXPECTED_SHA256 install.sh" | sha256sum -c - less install.sh bash install.sh

T08 · Insecure Dependencies

Warning

Location: SKILL.md:25
Finding: Unpinned External Binary and Package Distribution Channels
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 25-34
Vulnerability Type: Insecure dependency and executable distribution
Risk Level: Medium

Vulnerable Code

bash
brew install covoyage/tap/kairoa scoop bucket add covoyage https://github.com/covoyage/scoop-bucket scoop install kairoa tar -xzf kairoa_*.tar.gz && sudo mv kairoa /usr/local/bin/

The same section directs users to obtain a platform binary from:

text
https://github.com/covoyage/kairoa-cli/releases/latest

Technical Analysis

The documented installation procedures trust mutable external package repositories, package manifests, and the moving releases/latest reference. No exact package version, immutable release identifier, expected checksum, signature, or provenance verification is required.

Homebrew and Scoop provide package-management safeguards, but adding a third-party tap or bucket extends trust to its maintainer and repository. A compromised manifest can redirect downloads or update expected hashes to match an attacker-controlled artifact. Likewise, a moving latest-release reference can resolve to an artifact that did not exist when this Skill was reviewed.

The project contains only SKILL.md; it does not include the Kairoa implementation. Consequently, the binary's claimed behavior cannot be independently validated from the audited artifact. This is material because the documentation encourages the Agent to prefer the binary for many tasks involving sensitive files, credentials, outbound connections, and local network scanning.

Attack Path

An attacker compromises the upstream project, release workflow, Homebrew tap, Scoop bucket, or maintainer account.

The attacker publishes a malicious binary or changes a package manifest to retrieve one.

A user follows the unpinned installation instructions.

The package manager or latest-release link installs the substituted executable un ...[truncated 1462 chars]
Remediation: View remediation
Remediation Suggestions

Replace moving references such as releases/latest with a specific audited release version.

Pin Homebrew and Scoop installation guidance to reviewed package revisions where supported.

Publish checksums and cryptographic signatures for every platform artifact.

Require checksum and signature verification in the manual installation instructions.

Document the expected repository owner, release tag, artifact name, signer identity, and digest.

Protect release workflows with branch protection, mandatory review, isolated signing credentials, and provenance attestations.

Avoid system-wide installation unless necessary; prefer a user-owned executable directory with restricted write permissions.

Do not automatically install the dependency on behalf of an Agent. Require explicit user authorization.

Before sensitive operations, verify the executable version and digest against an approved allowlist.

Limit each invocation to the files, environment variables, network targets, and credentials needed for that specific task.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (18)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.
md
# 手动下载 # 从 https://github.com/covoyage/kairoa-cli/releases/latest 下载对应平台二进制 # 支持: macOS(ARM64/x86_64), Linux(ARM64/x86_64), Windows(x86_64) tar -xzf kairoa_*.tar.gz && sudo mv kairoa /usr/local/bin/ # 从源码构建 (Go >= 1.25) cd /path/to/kairoa-cli && go build -o kairoa .

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.
md
- User-Agent 解析 - HTTP 状态码参考 - Docker / Git 命令生成 - .env 文件管理 - 密码保险库（AES-GCM + Argon2id 加密） - WebSocket 连接测试 - AI Chat（OpenAI 兼容接口，支持流式/交互式）

Credential Access

High

Category: Privilege Escalation
Confidence: 87% confidence
Finding: The skill documents commands that enumerate and retrieve values from .env files, which commonly contain API keys, tokens, and passwords. In an agent context, encouraging use of env list or env get without explicit authorization boundaries can facilitate credential disclosure from the workspace or host.
Content: Scanner excerpt · SKILL.md (reported line 395)May include surrounding context.
环境变量管理

bash
kairoa env list # 列出 .env 文件内容 kairoa env get KEY # 获取指定变量

External Model or Provider Selection

High

Category: Excessive Agency
Confidence: 90% confidence
Finding: The skill exposes external model/provider selection and couples it with direct API-key usage, including alternate providers. In an agent setting, this can route potentially sensitive prompts to different third parties with different retention, logging, or policy controls, increasing confidentiality and supply-chain risk.
Content: Scanner excerpt · SKILL.md (reported line 489)May include surrounding context.
md
kairoa aichat send "write a haiku" --stream # 指定模型 kairoa aichat send "hello" -m gpt-4o -k $OPENAI_API_KEY # 自定义 API 端点（兼容 OpenAI 格式） kairoa aichat send "hello" -u https://api.anthropic.com/v1 -k $ANTHROPIC_API_KEY

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.
md
# 手动下载 # 从 https://github.com/covoyage/kairoa-cli/releases/latest 下载对应平台二进制 # 支持: macOS(ARM64/x86_64), Linux(ARM64/x86_64), Windows(x86_64) tar -xzf kairoa_*.tar.gz && sudo mv kairoa /usr/local/bin/ # 从源码构建 (Go >= 1.25) cd /path/to/kairoa-cli && go build -o kairoa .

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.
bash
# GET kairoa http get https://api.example.com/users kairoa http get https://api.example.com -i # 显示响应头 # POST

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.
bash
# GET kairoa http get https://api.example.com/users kairoa http get https://api.example.com -i # 显示响应头 # POST

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 528)May include surrounding context.
bash
# GET kairoa http get https://api.example.com/users kairoa http get https://api.example.com -i # 显示响应头 # POST

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill explicitly documents full-range, high-concurrency port scanning but does not place an authorization or impact warning adjacent to those commands. In an agent context, this can normalize intrusive network recon against third-party targets and increase the chance of unauthorized scanning or service disruption.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 333)May include surrounding context.
文件权限

bash
kairoa chmod 755 # 显示权限详情

键盘键码

Rp1

Medium

Category: MCP Rug Pull
Confidence: 75% confidence
Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 75% confidence
Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The AI Chat section explains how to send prompts and API keys to third-party endpoints, including custom base URLs, but does not clearly warn that prompts, outputs, and possibly metadata leave the local environment. In a security-sensitive agent workflow, that omission can lead users to unknowingly transmit proprietary or regulated data to external providers.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 486)May include surrounding context.
md
kairoa aichat send "hello" -k sk-xxxxx # 流式响应（实时输出） kairoa aichat send "write a haiku" --stream # 指定模型 kairoa aichat send "hello" -m gpt-4o -k $OPENAI_API_KEY

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 486)May include surrounding context.
md
kairoa aichat send "hello" -k sk-xxxxx # 流式响应(实时输出) kairoa aichat send "write a haiku" --stream # 指定模型 kairoa aichat send "hello" -m gpt-4o -k $OPENAI_API_KEY

External Transmission

Medium

Category: Data Exfiltration
Confidence: 86% confidence
Finding: This example explicitly configures a custom external AI API endpoint, which broadens the set of possible third-party destinations for user prompts and credentials. In the absence of a strong trust/privacy warning, it increases the risk of data being sent to an unreviewed or malicious provider.
Content: Scanner excerpt · SKILL.md (reported line 492)May include surrounding context.
md
kairoa aichat send "hello" -m gpt-4o -k $OPENAI_API_KEY # 自定义 API 端点（兼容 OpenAI 格式） kairoa aichat send "hello" -u https://api.anthropic.com/v1 -k $ANTHROPIC_API_KEY # 交互式聊天（多轮对话） kairoa aichat interactive

External Script Fetching

Low

Category: Supply Chain
Confidence: 15% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.
md
验证: `kairoa version` > **安全提示**: 也可通过快速安装脚本安装 (`curl -sSL https://raw.githubusercontent.com/covoyage/kairoa-cli/main/install.sh | bash`)，但建议先审查脚本内容再执行，不要以 root 身份运行未经审查的远程脚本。如需更高可信度，推荐从源码构建。 ---

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The instruction says '对中文用户，优先加 -l zh 获取中文输出', which sets language behavior based on inferred user identity rather than an explicit preference. The policy allows language constraints when the user is offered a choice or opts in, which is not stated here.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Chaining Abuse

Credential Access

Credential Access

环境变量管理

External Model or Provider Selection

Sudo/Root Execution

External Transmission

External Transmission

External Transmission

Missing User Warnings

Sudo/Root Execution

文件权限

键盘键码

Rp1

Rp1

Missing User Warnings

Session Persistence

Session Persistence

External Transmission

External Script Fetching

Natural-Language Policy Violations

Static analysis