Kiipu

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 3:55 AM UTC
• Version: 0.0.1

Overview

This skill is a disclosed Kiipu CLI helper whose sensitive actions match its stated post-management purpose, but users should be careful with permanent purge commands and the global npm CLI install.

Install only if you trust the Kiipu CLI package source, and treat purge as irreversible. Before running delete, restore, or purge, verify the exact post ID yourself; consider using a pinned CLI version or isolated install if you need stricter supply-chain control.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:26

Finding

Unpinned Globally Installed CLI Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 26–30
Vulnerability Type: Supply-chain risk from an unpinned third-party executable
Risk Level: Medium

markdown

## Installation

```bash
npm install -g @kiipu/cli

text

### Technical Analysis

The skill directs users or AI agents to install the latest version of `@kiipu/cli` globally without specifying a reviewed version, lockfile, integrity hash, or signed provenance requirement. The package is then trusted to process authentication credentials, API keys, post content, and destructive post-management operations.

Because npm resolves the version dynamically from the configured registry, the code installed during one invocation may differ from the code available when the skill was audited. The CLI implementation and its transitive dependencies are not included in this repository, so their installation hooks, network behavior, credential handling, and runtime actions could not be verified.

There is no evidence in the audited files that `@kiipu/cli` is currently malicious. The vulnerability is the unsafe trust model: a compromised package release, maintainer account, registry, or dependency could introduce attacker-controlled installation or runtime code.

### Attack Path

1. A user or agent follows the skill instruction and runs `npm install -g @kiipu/cli`.
2. npm resolves the current package version and transitive dependencies from the configured registry.
3. A compromised release or dependency executes malicious installation hooks or runtime code with the invoking user's privileges.
4. The malicious code reads locally available Kiipu credentials, API keys, post content, or other data accessible to the user.
5. It may exfiltrate that information, alter Kiipu resources, execute unrelated local commands, or persist changes within locations writable by the user.

### Impact Assessment

Successful exploitation could grant att
...[truncated 678 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to a specifically reviewed version:

   bash

   npm install -g @kiipu/cli@<reviewed-version>
   

2. Prefer a project-local, lockfile-controlled installation over a global installation:

   bash

   npm install --save-exact @kiipu/cli@<reviewed-version>
   

3. Commit and enforce an npm lockfile so the complete transitive dependency graph is reproducible.

4. Verify npm package integrity and provenance before installation, including publisher identity, registry origin, package signatures or attestations, and expected integrity hashes.

5. Audit the CLI package, lifecycle scripts, and transitive dependencies independently because their implementation is outside this repository.

6. Run the CLI with the minimum necessary operating-system and Kiipu permissions. Avoid exposing unrelated secrets through environment variables.

7. Establish a controlled update process in which new versions are reviewed and tested before the pinned version is changed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill documents and encourages execution of destructive delete and especially irreversible purge operations without any requirement to confirm user intent, restate the target post ID, or warn about permanence. In an agent context, this increases the chance of accidental or socially engineered data loss because the assistant may execute high-impact commands immediately once prompted.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.