Kuren

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:13 PM UTC
• Version: 0.1.0

Overview

The skill matches its stated Kuren identity and email purpose, but users should review it because it installs an unpinned external CLI and creates persistent credentials for external messaging.

Install only if you trust the `kuren` Cargo package and are comfortable with an agent having persistent Kuren credentials that can send and read email/messages. Treat `~/.kuren/` as sensitive, use restrictive permissions and encrypted backups, review message contents before sending, and look for clear logout, revocation, and version-pinning guidance before production use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:4
• Finding: Unpinned Third-Party CLI Dependency## Vulnerability Details **File Location**: `SKILL.md`, lines 4 and 12–17 **Vulnerability Type**: Supply-chain risk caused by an unpinned executable dependency **Risk Level**: Medium ### Vulnerable Code ```yaml compatibility: Requires the `kuren` CLI binary on PATH. Install with `cargo install kuren`. ``` ```yaml openclaw: requires: bins: ["kuren"] install: - id: cargo kind: cargo package: kuren ``` ### Technical Analysis The skill directs users or the hosting framework to install the third-party `kuren` Cargo package without specifying an exact version, lockfile requirement, source revision, checksum, or other integrity constraint. Consequently, installation may resolve whatever package release is current at that time rather than the release reviewed when this skill was published. Cargo installation compiles the selected package and its dependency graph locally. Build scripts and compiler-driven installation activity execute with the privileges of the user performing the installation. Because the audited project contains only `SKILL.md` and does not include the CLI source, the effective behavior of the installed executable cannot be verified from this artifact. This finding establishes an insecure dependency-management practice, not evidence that the current `kuren` package is malicious. ### Attack Path 1. A user or agent framework processes the skill's installation metadata. 2. It executes the documented equivalent of `cargo install kuren`. 3. Cargo resolves a mutable registry release and its transitive dependencies without an exact reviewed version constraint. 4. An attacker compromises the package, a dependency, or the relevant publication channel and publishes a malicious release that satisfies the unconstrained request. 5. Cargo downloads and compiles the compromised package or dependency. 6. Malicious build-time logic executes with the installing user's privileges, or t ...[truncated 939 chars]
• Remediation: ## Remediation Suggestions 1. Pin the dependency to an exact, reviewed release: ```bash cargo install kuren --version '=X.Y.Z' --locked ``` 2. Add the exact version to the skill's installation metadata rather than relying on the latest registry release. 3. Require locked dependency resolution so the published `Cargo.lock` is honored where supported. 4. Document the canonical package registry and upstream source repository to reduce dependency-confusion and package-substitution risk. 5. Verify release provenance using signed releases, trusted publisher identity, or reproducible-build attestations. 6. Publish and verify cryptographic checksums for approved artifacts where prebuilt binaries are used. 7. Review the pinned package, its build scripts, and its transitive dependencies before approving version updates. 8. Perform installation and execution with least privilege, preferably in a sandbox that restricts filesystem, credential, and network access.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Session Persistence

Medium

• Category: Rogue Agent

Content

## Setup (first time only)

```bash
# 1. Create your identity (generates Ed25519 keypair locally)
kuren auth signup <handle>

# 2. Log in (challenge-response auth, no password)

• Confidence: 78% confidence
• Finding: This skill establishes a persistent identity, local key material, and authenticated session state for an agent, which increases the risk of long-lived access being reused outside the user's immediate intent. In context, persistence is a core feature rather than an overtly malicious mechanism, but without clear scoping and lifecycle warnings it can enable unintended continued access to messaging and email capabilities across sessions.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs the user to create a cryptographic identity and states that keys are stored in ~/.kuren/, but it does not clearly frame those keys as sensitive credentials requiring strict filesystem protection and careful handling. Even though backup is mentioned, the absence of security guidance increases the chance of key theft, accidental sharing, or insecure backups that could let an attacker impersonate the agent or access associated services.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill enables sending email and direct messages to arbitrary external recipients but does not include any warning that these actions transmit data outside the local environment. In an agent setting, this creates a meaningful risk of unintended disclosure of sensitive prompts, user data, internal reasoning, or proprietary information if the skill is used without explicit user awareness and approval.

Static analysis

No suspicious patterns detected.