Kiro

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:55 AM UTC
• Version: 1.0.0

Overview

This Kiro workflow skill is mostly a coherent guide, but it includes high-impact automation and MCP examples with weak safety controls that users should review carefully before installing.

Install only if you are comfortable reviewing and tightening the Kiro hook and MCP examples before use. Pin package versions, avoid npx -y for credentialed MCP servers, use least-privilege tokens, restrict filesystem paths, review hooks before enabling them, and do not pass untrusted spec names to scripts/create-spec.py.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: references/mcp-servers.md:21

Finding

Unpinned Third-Party Packages Are Downloaded and Executed with Access to Sensitive Credentials

Content

View full analysis

` may resolve a mutable package release from the configured package registry at execution time. The `-y` option suppresses installation confirmation. Consequently, following the documentation can immediately download and execute package code that was not part of the audited Skill artifact. The risk is amplified for MCP servers because the downloaded process is explicitly given authentication tokens or database connection strings. Environment-variable substitution prevents credentials from being hardcoded in the repository, but it does not protect those credentials from the subprocess receiving them. A compromised package can read every environment variable passed to it and can use ordinary user-level network and filesystem access. The MCP network behavior is relevant to the declared functionality because these servers le ...[truncated 1834 chars]

Remediation

View remediation

" ] ``` 2. Pin the Kiro CLI to an exact version rather than installing the mutable latest release. 3. Prefer project-local dependencies installed from a committed lockfile over global installation or on-demand `npx` resolution. 4. Use package-manager integrity controls, trusted registries, provenance verification, and dependency signature or checksum validation where available. 5. Review package ownership, release history, transitive dependencies, and published provenance before recommending an MCP implementation. 6. Disable unnecessary MCP servers and start integrations only when required. 7. Issue separate credentials for each integration and restrict each credential to the minimum repository, workspace, database, operation, and lifetime required. 8. Avoid forwarding the parent process's full environment. Construct an explicit minimal environment containing only required variables. 9. Run MCP servers in a restricted sandbox with outbound-network allowlists and narrowly scoped filesystem access. 10. Document credential revocation and rotation procedures for suspected package compromise. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: references/hooks-reference.md:15

Finding

Unquoted File Placeholders Permit Shell Command Injection in Hook Examples

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/create-spec.py:140

Finding

Spec Name Path Traversal Allows File Creation and Overwrite Outside the Intended Directory

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

声明描述的是一个覆盖 Kiro 多项核心能力的综合工作流指南/工具，但实际代码块只实现了单一功能：创建 spec 模板文件。它没有展示 hooks、steering、MCP、powers 等任何相关实现，也没有体现完整开发流程支持。尽管代码与“用 Kiro 创建 specs”这一子项部分一致，但与整体声明相比范围明显更窄，属于描述显著宽于实际行为的情况，因此应判定为不匹配。

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/mcp-servers.md (reported line 204)May include surrounding context.

md

## 环境变量管理

### 使用 .env 文件

在项目根目录创建 `.env`：

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description and the document body present the skill entirely in Chinese, with no indication that users can choose another language or that the skill is intentionally limited to Chinese-speaking users. This creates a language/locale policy concern because it imposes a specific language by default rather than via explicit opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The entire template is written as a prescriptive project rules file in Chinese, including headings, examples, and placeholder guidance, but it does not indicate that language selection is optional or that the template is intended only for a specific Chinese-language context. This creates a natural-language locale policy issue because it effectively forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This section documents a file.delete hook that automatically runs rm {{test_file}} when matching files are deleted. Although it shows the mechanism, it does not warn readers that the hook can perform additional file deletions automatically, which could affect user data and should be explicitly disclosed in markdown per the warning requirement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The git.push example triggers vercel --prod, which can change live production state when a user pushes to main. The documentation presents this as a straightforward example but does not include a warning that enabling such hooks can cause immediate remote side effects and should be used only with deliberate user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This example uses $SLACK_WEBHOOK with curl -X POST, demonstrating an outbound network call tied to an environment variable that may transmit repository or system context externally. The surrounding documentation does not warn users about privacy implications, secret handling, or the fact that hooks can send data to third-party services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The document advertises high-impact MCP capabilities such as writing local files, exporting/importing database data, and sending Slack messages, but it does not clearly warn that these actions can mutate user data or affect external systems. In an agentic IDE context, normalizing these capabilities without prominent caution increases the risk of unsafe automation, accidental destructive actions, or unintended data exfiltration through connected tools.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown template is written as the default skill/spec format in Chinese, including headings, instructions, and checklist items, but it does not indicate that language selection is optional or limited to a justified region-specific context. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring presents the tool description, usage, and examples in Chinese only. This imposes a specific language on users without any opt-in or documented locale constraint, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The generated requirements, design, and tasks templates include multiple Chinese placeholders and instructions, which effectively steers output toward a fixed language/locale. Because no opt-in or justification is provided, this can conflict with natural-language policy expectations.

Content

No source excerpt is available for this finding.