CLI Worker Skill (Kimi CLI)

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:58 PM UTC
• Version: 0.3.0

Overview

This appears to be a real coding-delegation tool, but it gives delegated CLI agents broad access that is not fully disclosed in the Kimi-focused skill description.

Review before installing. Use it only for repositories and prompts you are comfortable sending to the selected external CLI provider, pin the intended provider explicitly, and run it with a minimal environment that excludes unrelated secrets. Avoid using it from non-git directories unless you accept direct workspace modification, and check for an existing AGENTS.md before running tasks or cleanup.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: src/spawn/run.ts:34

Finding

Delegated CLI Agents Inherit the Complete Parent Process Environment

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/cli/execute.ts:139

Finding

Non-Git Execution Silently Loses Worktree Isolation and Overwrites AGENTS.md

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (50)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY.md (reported line 37)May include surrounding context.

md

- **Allowed:** Single segment only: alphanumeric and hyphens (e.g. UUIDs like `550e8400-e29b-41d4-a716-446655440000`). No path separators (`/`, `\`), no `..`, no leading hyphen.
- **Resolution:** Paths are resolved with `path.resolve(basePath, taskId)` and checked to remain under `basePath` before reading files or running `git worktree remove`. Invalid `taskId` is rejected with an error.

This prevents arbitrary file read (e.g. `status ../../../../etc/passwd`) and destructive worktree remove in arbitrary directories.

## Credentials and environment variables

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

A generic provider interface is broader than a Kimi-only delegation skill and should be treated as such for review and permissions. Broad abstractions increase the chance of future capability creep without corresponding manifest updates.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

A generic provider interface is broader than a Kimi-only delegation skill and should be treated as such for review and permissions. Broad abstractions increase the chance of future capability creep without corresponding manifest updates.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

A generic provider interface is broader than a Kimi-only delegation skill and should be treated as such for review and permissions. Broad abstractions increase the chance of future capability creep without corresponding manifest updates.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

A generic provider interface is broader than a Kimi-only delegation skill and should be treated as such for review and permissions. Broad abstractions increase the chance of future capability creep without corresponding manifest updates.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

A generic provider interface is broader than a Kimi-only delegation skill and should be treated as such for review and permissions. Broad abstractions increase the chance of future capability creep without corresponding manifest updates.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

A generic provider interface is broader than a Kimi-only delegation skill and should be treated as such for review and permissions. Broad abstractions increase the chance of future capability creep without corresponding manifest updates.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

A generic provider interface is broader than a Kimi-only delegation skill and should be treated as such for review and permissions. Broad abstractions increase the chance of future capability creep without corresponding manifest updates.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

A generic provider interface is broader than a Kimi-only delegation skill and should be treated as such for review and permissions. Broad abstractions increase the chance of future capability creep without corresponding manifest updates.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

A generic provider interface is broader than a Kimi-only delegation skill and should be treated as such for review and permissions. Broad abstractions increase the chance of future capability creep without corresponding manifest updates.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

A generic provider interface is broader than a Kimi-only delegation skill and should be treated as such for review and permissions. Broad abstractions increase the chance of future capability creep without corresponding manifest updates.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

A generic provider interface is broader than a Kimi-only delegation skill and should be treated as such for review and permissions. Broad abstractions increase the chance of future capability creep without corresponding manifest updates.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

A generic provider interface is broader than a Kimi-only delegation skill and should be treated as such for review and permissions. Broad abstractions increase the chance of future capability creep without corresponding manifest updates.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

A generic provider interface is broader than a Kimi-only delegation skill and should be treated as such for review and permissions. Broad abstractions increase the chance of future capability creep without corresponding manifest updates.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

A generic provider interface is broader than a Kimi-only delegation skill and should be treated as such for review and permissions. Broad abstractions increase the chance of future capability creep without corresponding manifest updates.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

A generic provider interface is broader than a Kimi-only delegation skill and should be treated as such for review and permissions. Broad abstractions increase the chance of future capability creep without corresponding manifest updates.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

A generic provider interface is broader than a Kimi-only delegation skill and should be treated as such for review and permissions. Broad abstractions increase the chance of future capability creep without corresponding manifest updates.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

A generic provider interface is broader than a Kimi-only delegation skill and should be treated as such for review and permissions. Broad abstractions increase the chance of future capability creep without corresponding manifest updates.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

A generic provider interface is broader than a Kimi-only delegation skill and should be treated as such for review and permissions. Broad abstractions increase the chance of future capability creep without corresponding manifest updates.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

A generic provider interface is broader than a Kimi-only delegation skill and should be treated as such for review and permissions. Broad abstractions increase the chance of future capability creep without corresponding manifest updates.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

A generic provider interface is broader than a Kimi-only delegation skill and should be treated as such for review and permissions. Broad abstractions increase the chance of future capability creep without corresponding manifest updates.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

A generic provider interface is broader than a Kimi-only delegation skill and should be treated as such for review and permissions. Broad abstractions increase the chance of future capability creep without corresponding manifest updates.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

A generic provider interface is broader than a Kimi-only delegation skill and should be treated as such for review and permissions. Broad abstractions increase the chance of future capability creep without corresponding manifest updates.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

A generic provider interface is broader than a Kimi-only delegation skill and should be treated as such for review and permissions. Broad abstractions increase the chance of future capability creep without corresponding manifest updates.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

A generic provider interface is broader than a Kimi-only delegation skill and should be treated as such for review and permissions. Broad abstractions increase the chance of future capability creep without corresponding manifest updates.

Content

No source excerpt is available for this finding.