T09 · Insecure Skill Coding Practices
Error
- Location
scripts/check_quota.py:25- Finding
Authentication Cookie Is Stored in Plaintext When Encryption Support Is Unavailable
- Content
View full analysis
- Remediation
View remediation
Security audit
Kimi Quota
Security checks for vulnerabilities and agentic risk
Overview
This skill does what it says by checking Kimi quota data, but it handles reusable login cookies and can store them with weak or no real encryption.
Install only if you are comfortable giving the skill a reusable Kimi login cookie. Avoid using --save unless cryptography is installed and you set a strong KIMI_QUOTA_KEY; otherwise the saved cookie may be exposed from your local config directory or backups. Prefer clearing saved credentials after use with --clear.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/check_quota.py:48- Finding
Cookie Encryption Key Is Derived from Predictable Machine Attributes
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:51- Finding
Third-Party Python Dependencies Are Installed Without Version or Integrity Pinning
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared behavior says the skill checks Kimi quota and account usage, but the analyzed behavior reportedly packages the skill directory into an archive, performs local archive creation/renaming, and does not implement the promised Kimi querying logic. This mismatch is a strong red flag because deceptive descriptions can hide unrelated or unauthorized actions, enabling stealthy data collection, packaging, or exfiltration under the pretense of a benign account utility.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill advertises code-related capabilities including environment access, filesystem reads/writes, network access, and shell usage, but does not declare any explicit tool scope or permissions boundaries. In an agent setting, this increases the chance the skill can access or perform actions beyond what a user would reasonably expect from a quota-checking utility, especially since it handles authentication material such as cookies.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The description says to use the skill when the user asks about several phrases or 'needs to check Kimi Code usage,' but it does not clearly bound when the skill should not activate. Terms like '剩余次数' and the broad condition about checking usage could overlap with general conversation and may cause unintended invocation without clearer scope or exclusions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The code sends a supplied or stored login cookie and derived authorization token in HTTP requests to external Kimi API endpoints. While the file broadly states it queries usage/subscription data, there is no direct runtime disclosure near the network operations that credential-bearing data will be transmitted to remote services.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The request headers force language and locale values such as "accept-language: zh-CN", "x-language: zh-CN", and "Asia/Shanghai". This is a natural-language/locale policy issue because the skill does not provide opt-in, configurability, or justification for imposing a specific language/region setting.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python return None try: response = requests.post(url, headers=headers, json={}, timeout=10) if response.status_code == 200: return response.json() except Exception:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python return None try: response = requests.post(url, headers=headers, json={}, timeout=10) if response.status_code == 200: return response.json() except Exception:
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
A second request repeats forced locale settings using Chinese language headers and the Asia/Shanghai timezone. Because this behavior is embedded in the skill and not exposed as a user option, it violates the locale-choice requirement.
- Content
Static analysis
No suspicious patterns detected.