Kimi Quota

• Analyzed: May 11, 2026, 7:30 AM
• Findings: 1
• Version: 1.0.1
• Hash: cada26b00601c16b2b4d61b3fed2b0fe535e8b1043948386c69fa289658517a0
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is designed to query Kimi API usage and subscription status by interacting with legitimate Kimi.com endpoints. While it handles sensitive session cookies (kimi-auth), it implements local encryption using the Fernet (cryptography) library with machine-derived keys and sets appropriate file permissions (0o600) for the storage directory (~/.config/kimi-quota/). The code in scripts/check_quota.py is transparent, lacks obfuscation, and does not exhibit any signs of data exfiltration to third-party servers.