Kilo CLI Coding Agent

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:50 AM UTC
• Version: 0.0.9

Overview

The skill is a coherent Kilo CLI automation helper, but it asks for broad GitHub write credentials and encourages autonomous external writes without enough scoping or redaction safeguards.

Install only if you are comfortable running Kilo CLI as an autonomous coding subprocess. Use a fine-grained, repository-scoped GitHub token without actions:write unless a specific task truly needs it, review all diffs before push or PR creation, and sanitize PR bodies or comments to remove prompts, logs, secrets, private paths, and internal context.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:20

Finding

Unpinned Global Installation of a Third-Party Executable

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20-23
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: High

Vulnerable Code Snippet:

sh

npm install -g @kilocode/cli

Technical Analysis

The installation command retrieves the current version of @kilocode/cli from the npm registry and installs it globally. It does not specify an exact audited version, use a lockfile, or verify the downloaded package's integrity.

Consequently, the code that executes on a user's system can change after this skill has been reviewed. A compromised package release, maintainer account, or upstream dependency could introduce arbitrary behavior. Global installation increases the potential effect because the executable becomes available across the user's environment rather than remaining isolated to the project.

Attack Path

1. An attacker compromises the package, its publishing account, or an upstream dependency.
2. The attacker publishes a malicious version under the existing package name.
3. A user follows the skill instructions and runs npm install -g @kilocode/cli.
4. npm retrieves and installs the attacker-controlled release.
5. The user or agent subsequently invokes kilo run.
6. The malicious executable runs with the invoking user's privileges and may access inherited environment variables, repositories, files, and network resources.

Impact Assessment

Successful exploitation permits arbitrary code execution with the privileges of the user running npm or Kilo CLI. The affected scope can include local source repositories, user-accessible files, inherited credentials such as GITHUB_TOKEN, and remote services reachable with those credentials. A privileged global installation could increase the system-wide impact.

Remediation

View remediation

Remediation Suggestions

• Pin the CLI to an exact, reviewed version, for example @kilocode/cli@X.Y.Z.
• Prefer a project-local installation rather than a global installation.
• Commit and enforce a lockfile that records transitive dependency versions and integrity hashes.
• Verify package provenance, publisher identity, signatures, and checksums where supported.
• Run the CLI in a restricted environment with only the repository and credentials required for the task.
• Establish an explicit review and upgrade process instead of automatically consuming the latest release.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: claw.json:9

Finding

Mandatory Overprivileged GitHub Token for Autonomous Processes

Content

View full analysis

Vulnerability Details

File Location: claw.json, lines 9-15
Vulnerability Type: Excessive credential scope and unnecessary mandatory access
Risk Level: High

Vulnerable Code Snippet:

json

"permissions": ["network", "exec"],
"entry": "SKILL.md",
"minOpenClawVersion": "0.8.0",
"env": [
  {
    "name": "GITHUB_TOKEN",
    "description": "GitHub Personal Access Token with repo and actions:write permissions",
    "required": true
  }
]

The corresponding skill metadata also makes the token a required primary environment variable:

yaml

requires:
  env:
    - GITHUB_TOKEN
  bins:
    - kilo
    - git
    - gh
    - tmux
primaryEnv: GITHUB_TOKEN

Technical Analysis

The skill requires a GitHub personal access token with repository and actions:write permissions while also declaring network and command-execution access. Workflow-write privileges are broader than necessary for local coding, reviewing changes, commenting on pull requests, or creating ordinary pull requests.

Because Kilo CLI and shell commands are launched as autonomous subprocesses, they may inherit the token from the environment. If the third-party CLI, one of its dependencies, or an agent-generated command is compromised, it can potentially use the token through the available network channel. Requiring the token even for operations that do not interact with GitHub further violates least privilege.

Attack Path

1. The user configures the mandatory GITHUB_TOKEN with repository and actions:write privileges.
2. The skill launches Kilo CLI or another shell subprocess with command-execution and network capabilities.
3. A compromised dependency, malicious generated command, or unsafe task accesses the inherited environment variable.
4. The process sends authenticated requests to GitHub.
5. The token is used to modify repository content, pull requests, or GitHub Actions resources within it ...[truncated 447 chars]

Remediation

View remediation

Remediation Suggestions

• Make GitHub authentication optional for tasks that do not require remote GitHub access.
• Use fine-grained, repository-scoped tokens with only the permissions needed for the requested operation.
• Remove actions:write from the default requirements and request it only for an explicitly approved workflow-management task.
• Use separate credentials for read-only reviews, pull-request creation, and workflow administration.
• Do not automatically pass the token to delegated subprocesses; construct a minimal environment for each command.
• Require user confirmation before performing authenticated write operations.
• Apply short expiration periods and rotate or revoke tokens after suspected exposure.

other

Warning

• Location: SKILL.md:185

Finding

Required Publication of Exact Prompts and Session Details in External Pull Requests

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 185-243
Vulnerability Type: Sensitive information disclosure through pull-request metadata
Risk Level: Medium

Vulnerable Code Snippet:

markdown

## Original Prompt
[Exact request/problem statement]

## What this does
[High-level description]

**Features:**
- [Key feature 1]
- [Key feature 2]

**Example usage:**
```bash
# Example
command example

Feature intent (maintainer-friendly)

[Why useful, how it fits, workflows it enables]

Prompt history (timestamped)

• YYYY-MM-DD HH:MM UTC: [Step 1]
• YYYY-MM-DD HH:MM UTC: [Step 2]

How I tested

Manual verification:

1. [Test step] - Output: [result]
2. [Test step] - Result: [result]

Files tested:

• [Detail]
• [Edge cases]

Session logs (implementation)

• [What was researched]
• [What was discovered]
• [Time spent]

Implementation details

New files:

• path/file.ts - [description]

Modified files:

• path/file.ts - [change]

Technical notes:

• [Detail 1]
• [Detail 2]

text

The template is reinforced as a required principle:

```markdown
**Key principles:**
1. Human-written description (no AI slop)
2. Feature intent for maintainers
3. Timestamped prompt history
4. Session logs if using Kilo CLI agent

Technical Analysis

The external pull-request template directs the agent to include the exact request, timestamped prompt history, and implementation session logs. Such content can contain confidential requirements, internal file paths, architecture details, unpublished vulnerability information, or other sensitive conversation context.

The instructions provide no mandatory redaction process, sensitivity review, or explicit user-approval gate before publication. When used with gh pr create or similar commands, this information may be sent to a third-party or publicly visible repository.

...[truncated 928 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the requirement to publish exact prompts and full session logs.
• Replace them with concise, sanitized summaries limited to information necessary for code review.
• Exclude secrets, credentials, private URLs, local paths, internal issue details, and unrelated conversation context.
• Add an explicit user-review and approval step before submitting any pull-request description externally.
• Treat public and third-party repositories as untrusted disclosure destinations.
• Provide a minimal default template containing only the change summary, testing performed, and relevant implementation notes.
• Add automated secret and sensitive-data scanning before invoking gh pr create or gh pr comment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.

8. Cleanup

tmux -S "$SOCKET" kill-server git worktree remove /tmp/issue-78 git worktree remove /tmp/issue-99

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.

8. Cleanup

tmux -S "$SOCKET" kill-server git worktree remove /tmp/issue-78 git worktree remove /tmp/issue-99

text

**Why worktrees?** Each Kilo CLI works in isolated branch, no conflicts. Can run 5+ parallel fixes!

Credential Access

High

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

Requiring a GITHUB_TOKEN with repo and actions:write permissions gives the skill access to modify repositories and trigger or alter CI workflows if the token is exposed or misused. In the context of a skill that also has network and exec permissions, this is especially sensitive because the token could be leveraged by executed commands or transmitted off-host.

Content

Scanner excerpt · claw.json (reported line 14)May include surrounding context.

json

"env": [
    {
      "name": "GITHUB_TOKEN",
      "description": "GitHub Personal Access Token with repo and actions:write permissions",
      "required": true
    }
  ]

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs posting review content to GitHub with gh pr comment but does not warn that the generated review text may contain sensitive repository data, prompts, or internal analysis that will be transmitted to an external service. In this skill’s context, the agent is encouraged to collect logs/results from autonomous runs, which increases the chance of unintended disclosure when comments are posted verbatim.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

These instructions direct the user/agent to git push and gh pr create against external repositories without a clear user-facing warning that code and metadata will leave the local environment and modify remote state. Because the skill is designed for autonomous coding workflows, this omission can lead to unreviewed publication of sensitive changes or accidental writes to third-party repos.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The rule endorses --full-auto because it auto-approves changes, reducing human oversight over code modifications performed by the agent. In a skill centered on background autonomous execution, this increases the chance of unsafe edits, destructive actions, or unintended external changes proceeding without review.

Content

Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.

md

1. **Respect tool choice** — if user asks for Kilo CLI, use Kilo CLI. NEVER offer to build it yourself!
2. **Be patient** — don't kill sessions because they're "slow"
3. **Monitor with process:log** — check progress without interfering
4. **--full-auto for building** — auto-approves changes
5. **vanilla for reviewing** — no special flags needed
6. **Parallel is OK** — run many Kilo CLI processes at once for batch work
7. **NEVER start Kilo CLI in ~/openclaw/** — it'll read your soul docs and get weird ideas about the org chart! Use the target project dir or /tmp for blank slate chats

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The PR template instructs inclusion of the exact original prompt, timestamped prompt history, and session logs in pull requests. That creates a direct pathway for leaking sensitive user instructions, credentials accidentally pasted into prompts, internal reasoning/workflow details, or proprietary context into public or third-party repositories.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest requests both network and exec permissions and also requires a GitHub token with elevated repository and actions write access, but it does not present any clear user-facing warning or justification in the manifest itself. This combination materially increases risk because the skill can execute arbitrary local commands and communicate externally while holding a sensitive credential, making misuse or accidental overreach more dangerous.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.