Security audit

KitchenOwl API

Security checks across malware telemetry and agentic risk

Overview

This KitchenOwl helper is coherent but needs Review because it stores reusable credentials locally and exposes broad authenticated API actions without tight scoping or safeguards.

Install only if you are comfortable giving the skill reusable access to your KitchenOwl account. Use HTTPS and a trusted instance, avoid putting passwords directly on the command line, check or restrict permissions on ~/.config/kitchenowl-api/session.json, prefer a limited or revocable token, and explicitly approve any write, POST, DELETE, or GraphQL mutation before it runs.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The script advertises and implements generic REST and GraphQL capabilities that are broader than the stated skill purpose of shopping-list read/update. In an agent-skill context, this expands the reachable attack surface and allows prompts or downstream tooling to invoke unrelated KitchenOwl API functionality, violating least privilege even if the author likely intended reusability.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The `request` command accepts arbitrary HTTP methods and paths and automatically attaches the stored bearer token, enabling any authenticated API action the account is authorized for. In an agent environment this can be abused to perform unintended reads, writes, or destructive actions far beyond shopping-list management if a user prompt or chained instruction steers the agent to call it.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The GraphQL helper accepts arbitrary queries and mutations with the current token, so it can access or modify any schema operation permitted to the account rather than only shopping-list data. Because GraphQL consolidates many capabilities behind one endpoint, this is especially risky in an agent skill: a single prompted mutation could perform sensitive or destructive state changes outside the declared scope.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill explicitly supports modifying shopping-list data and storing authentication tokens in a persistent local session file, but it does not warn users about state-changing operations or credential persistence. This can lead to unintended remote data modification and local token exposure, especially on shared systems or where users assume actions are read-only or ephemeral.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: Passing a password directly on the command line can expose it through shell history, process listings, audit logs, terminal recording, or multi-user system inspection. Because the documentation presents this as the normal login method without warning, users may inadvertently leak valid KitchenOwl credentials while authenticating to a live service.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The script persists access and refresh tokens to `~/.config/kitchenowl-api/session.json` without setting restrictive file permissions or clearly warning the user that long-lived credentials are being stored locally. On shared systems or lax umask settings, these tokens may be readable by other local users or accidentally exposed through backups and tooling, enabling account compromise.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.