NVIDIA Kimi Vision

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:25 PM UTC
• Version: 1.0.3

Overview

This skill does what it claims by sending images to NVIDIA for analysis, but it can upload any readable local file path and gives weak API-key handling guidance.

Review before installing. Use this only for files you intentionally want to send to NVIDIA, avoid confidential screenshots or documents, store the API key with restrictive permissions or a secret manager, and avoid passing the key directly on the command line.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/analyze_image.py:56

Finding

Arbitrary Local File Disclosure Through Unrestricted Image Upload

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/analyze_image.py:14

Finding

API Key Exposure Through Command-Line Arguments and Weak File-Storage Guidance

Content

View full analysis

~/.config/nvidia-kimi-api-key # Option B: Pass directly when running python3 scripts/analyze_image.py photo.jpg "What's this?" sk-your-key-here ``` ### Technical Analysis The documented inline-key method places the API key directly in the process argument list. Depending on the operating system and execution environment, command-line arguments may be exposed through shell history, process inspection, audit records, orchestration logs, or agent execution transcripts. The recommended file-creation command does not explicitly apply restrictive permissions. Its resulting mode depends on the user's current `umask`, which may permit access by other local users or services. There is also an implementation inconsistency. `get_api_key()` supports interpreting an input as either a literal key or a path, but the third command-line argument is assigned directly from `sys.argv[3]`. Consequently, a key-file path supplied in that position is treated as the bearer token itself rather than being read through `get_api_key()`. ### Attack Path 1. A user follows the documented example and passes the NVIDIA API key as the third command-line argument. 2. The command is ...[truncated 1065 chars]

Remediation

View remediation

~/.config/nvidia-kimi-api-key ``` 4. Validate the permissions and ownership of the key file before reading it, and reject files accessible by unintended users. 5. If a key-file argument remains supported, process it consistently: ```python api_key = get_api_key() if len(sys.argv) < 4 else get_api_key(sys.argv[3]) ``` 6. Avoid printing, logging, or embedding API keys in examples, error messages, telemetry, or agent execution records. 7. Document key rotation and revocation procedures so users can invalidate a credential if exposure is suspected. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill clearly instructs users to call an external NVIDIA API, which implies network access, but the manifest does not declare any corresponding tool scope or permissions. This can lead to under-scoped review, unexpected outbound data transfer, and weaker policy enforcement around what the skill is allowed to do.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation explains how to submit images and prompts to the NVIDIA service but does not warn that user-provided images and text leave the local environment and are processed by a third party. This creates a privacy and data-handling risk, especially if users submit sensitive screenshots, personal photos, or confidential documents without informed consent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

The skill recommends persisting an API key in a predictable file under ~/.config and also shows passing the key on the command line. Storing secrets without permission hardening and exposing them in shell history or process listings increases the chance of credential disclosure and subsequent abuse of the NVIDIA account or API quota.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

Step 2: Save the Key

bash

# Option A: Save to file (recommended)
mkdir -p ~/.config
echo 'your-api-key-here' > ~/.config/nvidia-kimi-api-key

# Option B: Pass directly when running

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 81% confidence

Finding

This code performs an outbound HTTP request to an external API and includes the prompt plus base64-encoded image data in the JSON payload. While external transmission is core to the skill's intended functionality, it is still a real security/privacy concern because potentially sensitive local data is exfiltrated to a remote service without any enforcement of consent, minimization, or content-sensitivity checks.

Content

Scanner excerpt · scripts/analyze_image.py (reported line 79)May include surrounding context.

python

print("Sending to Kimi...", flush=True)
    
    try:
        r = requests.post(
            INVOKE_URL,
            headers={"Authorization": f"Bearer {api_key}", "Content-Type": "application/json"},
            json=payload,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script sends the user-provided prompt and the full image contents to a third-party NVIDIA API, but it does not provide an explicit privacy or data-disclosure warning at the point of transmission. This can expose sensitive images or prompts to an external service unexpectedly, especially when used as a reusable skill inside a larger agent workflow where end users may not realize their data leaves the local environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 62% confidence

Finding

All example prompts are written in English and the skill does not state whether other languages are supported or let users choose a preferred language. While not a strong violation on its own, the natural-language guidance implicitly assumes English-only usage without documented justification or opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.