ClawHub
Back to skill

Security audit

Kairoa Toolkit

Security checks for vulnerabilities and agentic risk

Overview

This skill mainly documents how to open the Kairoa desktop app and use its tools, but users should avoid putting real secrets into deep-link URLs.

Install only if you already trust the Kairoa desktop app. Use deep links only with harmless sample data; do not put passwords, API keys, tokens, private keys, seed phrases, or personal data into kairoa:// URLs.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The deep-link feature is documented as supporting pre-filled data but omits any warning that URL parameters may disclose sensitive content. This can mislead users into passing secrets, keys, tokens, or personal data via `kairoa://` links, which are commonly visible to operating system handlers, logs, crash reports, browser history, copied text, and shoulder-surfing. Because the skill promotes many crypto/security-related utilities, users may be especially likely to pre-fill high-value data.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill includes a deep-link example that places a password directly in a `kairoa://` URL query string. Sensitive values in URLs can be exposed through logs, shell history, desktop/app telemetry, screenshots, or OS/application URL handling, so this encourages unsafe handling of secrets even if the example is only illustrative. In this skill context, the danger is increased because the app explicitly offers security tools and a password-related feature, which may lead users to treat it as safe for secret material.

Static analysis

No suspicious patterns detected.