Kiro CLI OpenClaw Bridge

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:55 AM UTC
• Version: 1.2.1

Overview

This is a real local bridge, but it exposes Kiro file and terminal capabilities through weakly controlled local APIs and auto-approved permissions.

Only install this if you understand that any process able to reach the bridge may be able to drive Kiro with your local file and command privileges. Keep it bound to 127.0.0.1, do not expose the port through tunnels, proxies, containers, or shared machines, use a dedicated low-privilege workspace without secrets, and prefer waiting for fixes that add real authentication, explicit per-action approval, enforced project-directory containment, and restricted command execution.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: acp_openai_bridge/acp_reader.py:235

Finding

Agent Permission Requests Are Automatically and Permanently Approved

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: acp_openai_bridge/acp_reader.py:278

Finding

Filesystem Tool Operations Are Not Restricted to the Configured Working Directory

Content

View full analysis

0: lines = lines[start_line:] if max_lines is not None and max_lines > 0: lines = lines[:max_lines] content = "".join(lines) result = {"content": content} logger.info("Read file: %s (%d chars)", file_path, len(content)) except FileNotFoundError: error = {"code": -32001, "message": f"File not found: {file_path}"} except Exception as exc: error = {"code": -32000, "message": str(exc)} elif method == "fs/write_text_file": file_path = params.get("path", "") content = params.get("content", "") try: os.makedirs(os.path.dirname(file_path) or ".", exist_ok=True) with open(file_path, "w", encoding="utf-8") as f: f.write(content) result = {} logger.info("Wrote file: %s (%d chars)", file_path, len(content)) except Exception as exc: error = {"code": -32000, "message": str(exc)} ``` ### Technical Analysis The file path is supplied by the ACP agent and passed directly to `open()` and `os.makedirs()`. The bridge does not canonicalize the path, verify that it is beneath the configured `--cwd`, reject absolute paths, detect `..` traversal, or prevent symbolic-link escapes. Consequently, the working directory only affects relative-path resolution; it is not a security boundary. This contradicts the documentation's claim that tool operations are restricted to the project directory. The write operation also creates parent directorie ...[truncated 1186 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: acp_openai_bridge/acp_reader.py:309

Finding

Agent-Controlled Arguments Are Executed Through a Shell with the Bridge Environment

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: acp_openai_bridge/routes.py:1

Finding

Capability-Bearing HTTP Endpoints Do Not Authenticate Callers

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: acp_openai_bridge/routes.py:92

Finding

Sensitive Prompt Content Is Written to Application Logs

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (53)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Exposing additional API surfaces such as /v1/messages and operating without API-key validation broadens access beyond the stated purpose and weakens the trust model. In a bridge that can trigger backend tool use, missing authentication is especially risky because a local or mistakenly exposed listener could be driven by unauthorized callers.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Exposing additional API surfaces such as /v1/messages and operating without API-key validation broadens access beyond the stated purpose and weakens the trust model. In a bridge that can trigger backend tool use, missing authentication is especially risky because a local or mistakenly exposed listener could be driven by unauthorized callers.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This reader/dispatcher component is documented as handling JSON-RPC routing, yet it also implements filesystem writes and shell execution. That functional overreach increases attack surface substantially because any ACP peer that can send requests to this reader can trigger privileged local actions unrelated to simple bridging.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 100% confidence

Finding

The permission handler automatically selects allow-like options, preferring allow_always, without user confirmation. That defeats the safety boundary intended by permission prompts and enables any connected agent to escalate from requesting access to receiving standing authorization for file or command actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Automatically approving permission requests without any user-visible confirmation removes an expected consent checkpoint for sensitive operations. In this skill, that directly compounds the file-write and command-execution capabilities, allowing a connected agent to perform high-risk local actions silently.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

A local protocol bridge is expected to translate messages, not expose broad shell execution to the remote side. Providing terminal/create, output, wait, kill, and release semantics here turns the bridge into a general-purpose remote command runner, magnifying the consequences of any misuse or compromise of the connected client.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Shell command execution occurs with no user-facing warning even though it can perform arbitrary host actions. Combined with inherited environment and optional cwd/env overrides, the connected agent can run reconnaissance, exfiltration, or destructive commands without meaningful user awareness.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · acp_openai_bridge/acp_reader.py (reported line 314)May include surrounding context.

python

cwd = params.get("cwd")
            env_vars = params.get("env", [])
            try:
                env = os.environ.copy()
                for ev in env_vars:
                    if isinstance(ev, dict):
                        env[ev.get("name", "")] = ev.get("value", "")

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The command parameters are fully agent-controlled and passed to subprocess with shell=True, so the tool interface can be abused to execute arbitrary OS commands beyond any intended safe subset. In this bridge context the tool is effectively a remote shell endpoint, making prompt- or protocol-level manipulation highly dangerous.

Content

Scanner excerpt · acp_openai_bridge/acp_reader.py (reported line 327)May include surrounding context.

python

logger.info("Terminal exec: %s (cwd=%s)", cmd_str, cwd)

                proc = subprocess.run(
                    cmd_str,
                    shell=True,
                    capture_output=True,

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · build.sh (reported line 17)May include surrounding context.

sh

if [ "${1:-}" = "clean" ]; then
    echo "Cleaning build artifacts..."
    rm -rf build/ dist/ __pycache__/ *.egg-info/
    echo "Done."
    exit 0
fi

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 47)May include surrounding context.

md

pip install -r requirements.txt -q

echo "Building acp-bridge executable..."
pyinstaller acp_bridge.spec --clean --noconfirm

BINARY="dist/acp-bridge"
if [ -f "$BINARY" ]; then

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 240)May include surrounding context.

md

pip install -r requirements.txt -q

echo "Building acp-bridge executable..."
pyinstaller acp_bridge.spec --clean --noconfirm

BINARY="dist/acp-bridge"
if [ -f "$BINARY" ]; then

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · articles/wechat.md (reported line 160)May include surrounding context.

md

pip install -r requirements.txt -q

echo "Building acp-bridge executable..."
pyinstaller acp_bridge.spec --clean --noconfirm

BINARY="dist/acp-bridge"
if [ -f "$BINARY" ]; then

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · build.sh (reported line 37)May include surrounding context.

sh

pip install -r requirements.txt -q

echo "Building acp-bridge executable..."
pyinstaller acp_bridge.spec --clean --noconfirm

BINARY="dist/acp-bridge"
if [ -f "$BINARY" ]; then

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation explicitly promotes running the bridge with the user's full local privileges and highlights direct file-system and CLI access as a feature, even though the stated purpose is only protocol bridging between OpenClaw and kiro-cli. This materially expands the attack surface: any prompt sent through the client could induce sensitive local actions, and the document provides no sandboxing, consent gates, or scope restrictions.

Content

No source excerpt is available for this finding.

Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'

High

• Category: Supply Chain
• Confidence: 70% confidence

Finding

Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: pytest==8.3.5 — 2 advisory(ies): CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 59)May include surrounding context.

bash

# 健康检查
curl http://127.0.0.1:18788/health

# 快速测试
curl -X POST http://127.0.0.1:18788/v1/chat/completions \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README describes a local HTTP bridge that forwards prompts and tool calls into a persistent kiro-cli acp process scoped to --cwd, but the warning is brief and easy to miss. Because the bridge exposes OpenAI-compatible endpoints and tool passthrough, a user may underestimate that any local client able to reach the port can trigger actions against the selected project directory through Kiro CLI.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill documents a bridge that exposes network, shell, file, and environment-adjacent capabilities, but it does not declare any explicit permission or allowed-tools scope. That omission increases the chance that users or platforms will underestimate the bridge's effective access, especially because the bridge fronts kiro-cli tool execution behind an HTTP API.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

bash

# 健康检查
curl http://127.0.0.1:18788/health
# 应返回：{"status":"ok","acp_available":true}

# 模型列表

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The docstring says terminal/create "Creates a terminal and runs a command" and companion methods imply a live terminal lifecycle with output, waiting, release, kill. In reality, the code calls subprocess.run with a 30-second timeout, waits for completion immediately, and stores static output in a dictionary, so the documented semantics of an interactive terminal are contradicted by the implementation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file-write path accepts arbitrary agent-provided paths and content and writes them directly without warning or confirmation. In a bridge exposed to an LLM-driven agent, this can be exploited to overwrite config files, drop startup scripts, or modify project code silently.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 99% confidence

Finding

The code executes agent-supplied command text via subprocess.run(..., shell=True), which allows arbitrary shell metacharacters, chaining, redirection, and expansion. In a local bridge context this grants the connected agent effective code-execution capability on the host, which is far broader than passive protocol translation and can be abused for data theft, persistence, or destructive actions.

Content

Scanner excerpt · acp_openai_bridge/acp_reader.py (reported line 327)May include surrounding context.

python

logger.info("Terminal exec: %s (cwd=%s)", cmd_str, cwd)

                proc = subprocess.run(
                    cmd_str,
                    shell=True,
                    capture_output=True,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The translator logs message-role metadata and emits previews of message contents, including user and potentially system prompt text. In this bridge context, requests may contain secrets, API keys, proprietary prompts, or sensitive user data, so writing even partial content to logs creates an information disclosure risk if logs are retained, aggregated, or accessed by other users or operators.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.