Kiro CLI OpenClaw Bridge

• Outcome: Review
• Latest audit: Jul 29, 2026 · 9:40 AM UTC
• Version: 1.2.1

Overview

This is a powerful local bridge that fits its stated purpose, but it auto-approves permissions and exposes unrestricted local file and shell actions beyond the documented scope.

Only use this in a trusted local project, bound to localhost, and not with untrusted chat clients or shared channels. Treat connected prompts as capable of reading/writing files and running shell commands as your user; review the code or add authentication, explicit permission prompts, path allowlists, and command restrictions before broader use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (20)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

logger.info("Terminal exec: %s (cwd=%s)", cmd_str, cwd)

                proc = subprocess.run(
                    cmd_str,
                    shell=True,
                    capture_output=True,

• Confidence: 98% confidence
• Finding: The bridge executes agent-supplied command data via subprocess.run(..., shell=True) after joining arguments into a shell string, which enables arbitrary shell execution and shell metacharacter injection. In this skill’s context, the command request originates from the connected agent/backend, so a compromised or overly-permissive agent can run local commands on the host without meaningful mediation.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill exposes substantial capabilities including network access, shell execution, and file read/write, but does not declare permissions. That omission prevents users and platforms from making an informed trust decision before installation or use. In this context, the bridge is designed to proxy model/tool calls into a local CLI backend, so hidden capabilities materially increase the risk of unintended local command execution or file access.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The documented purpose frames the skill as a local compatibility bridge, but the detected behavior includes permission handling, arbitrary file access, shell execution, and an additional API surface. That mismatch is dangerous because users may deploy it expecting simple protocol translation while it can mediate powerful local actions through kiro-cli tools, potentially enabling destructive commands or data exposure if prompts or connected clients are untrusted. The fact that the service exposes OpenAI/Anthropic-compatible endpoints makes this more sensitive, because any local client able to reach the bridge may trigger those capabilities indirectly.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This bridge does far more than protocol translation: it implements local file reads, file writes, and command execution on behalf of the agent. That materially expands the trust boundary beyond the manifest’s stated integration role, making the local machine reachable through the bridge if the remote agent issues these requests.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The permission handler automatically selects an allow option, preferring allow_always, without any user confirmation. This defeats the safety model of permission prompts and permits chained high-risk actions such as file modification or command execution with no human review.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The terminal/create handler gives the agent arbitrary subprocess execution capability on the local host. Because it accepts agent-controlled args, cwd, and env and then runs them with shell=True, the bridge effectively exposes remote code execution through the protocol.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The fs/write_text_file handler permits arbitrary local file writes to agent-specified paths, creating or overwriting files without restriction. An attacker or compromised agent could alter application configs, shell startup files, scripts, or project source to establish persistence or sabotage the system.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The document explicitly promotes a bridge where prompts from an OpenAI-compatible client are forwarded into a local agent running with the user's full OS privileges, including file-system access and CLI execution. This expands the trust boundary from 'chat completion proxy' to 'arbitrary local action surface' without authentication, authorization, or safety gating, making prompt-driven misuse or accidental destructive actions much more likely.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Permission prompts are automatically approved without user awareness, which nullifies the intended safeguard before dangerous tool actions occur. In a bridge that already exposes file and terminal primitives, this dramatically increases exploitability because there is no effective human checkpoint.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The file write path performs local modifications with no user-facing notice or confirmation. While some tools legitimately write files, in this bridge context the writes are initiated by the agent and can target arbitrary paths, so silent operation materially raises the chance of unauthorized changes.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Shell command execution occurs without any warning or consent, allowing the agent to run local commands invisibly through the bridge. Because command execution is one of the highest-risk capabilities, silent approval makes compromise or misuse far more damaging.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The translator logs a preview of message content derived from user input, which can expose prompts, secrets, personal data, or proprietary text to application logs. In this bridge context, requests may carry sensitive LLM conversations, and debug logging increases the chance of unintended disclosure through local files, log aggregators, or support bundles.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The route logs prompt metadata plus a preview of translated.content, which includes user-supplied prompt text. This can expose sensitive user data, secrets, proprietary content, or regulated information to application logs, which are often retained, aggregated, and accessible to operators or other systems beyond the original request path.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The article promotes file write and terminal execution capabilities as features but does not clearly warn that these actions can modify user data, execute destructive commands, or be triggered through an external chat interface. In this context, readers may enable a bridge that expands an AI agent's operational reach without understanding the resulting risk to local files and system integrity.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document encourages exposing Kiro CLI capabilities through OpenClaw to multiple chat platforms but does not warn that prompts from those platforms may lead to local tool execution or disclosure of sensitive project data. Bridging a local privileged CLI to external messaging ecosystems materially increases the attack surface, including prompt injection, unauthorized access via connected accounts, and accidental data leakage.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The markdown explicitly advertises project file writes and terminal command execution as capabilities, but does not include a clear warning that connecting a chat platform to a local agent backend can let remote prompts trigger sensitive local actions. In the context of an integration bridge exposing Kiro CLI capabilities through an OpenAI-compatible HTTP API, this omission increases the chance that users deploy it without understanding the risk of destructive commands, data exposure, or workspace modification.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The markdown describes direct local file-system and CLI access as a feature, but does not warn that connecting an external chat client to such capabilities can enable prompt-triggered local actions under the user's account. In this skill context, that omission is especially dangerous because the bridge is presented as a convenient integration path, which may cause users to expose powerful local automation without understanding the consequences.

Unvalidated Output Injection

High

• Category: Output Handling

Content

logger.info("Terminal exec: %s (cwd=%s)", cmd_str, cwd)

                proc = subprocess.run(
                    cmd_str,
                    shell=True,
                    capture_output=True,

• Confidence: 95% confidence
• Finding: The subprocess invocation consumes agent-controlled command content and passes it to the shell, enabling command injection and execution of unintended operations. The dangerous aspect is not merely output handling but that untrusted input is transformed into a shell command in a privileged local context.

Known Vulnerable Dependency: pytest==8.3.5 — 2 advisory(ies): CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)

High

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: The dependency pins pytest to a version reported by the scanner as affected by a high-severity tmpdir handling vulnerability. Even though pytest is usually a test-only dependency, vulnerable tooling can still be exploited in CI, local developer environments, or packaging workflows if untrusted test inputs or repositories are processed.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

logger.info("Terminal exec: %s (cwd=%s)", cmd_str, cwd)

                proc = subprocess.run(
                    cmd_str,
                    shell=True,
                    capture_output=True,

• Confidence: 98% confidence
• Finding: Tool parameters from the agent are trusted too broadly and directly control subprocess execution. This is a classic parameter abuse issue: the bridge exposes a powerful tool but performs no meaningful validation, authorization, or containment before executing attacker-influenced inputs.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.