openclaw-kilo-agent

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:04 PM UTC
• Version: 1.0.0

Overview

The skill is coherent, but it tells agents to run a powerful coding and browser automation tool with unconditional auto-approval and an unpinned executable MCP dependency.

Review this skill carefully before installing. Use it only in an isolated workspace or low-privilege account, avoid exposing real browser sessions or secrets, pin and review the MCP server package before use, and do not run `--auto` for file writes, authenticated browsing, form submission, deletion, publishing, or external-account actions without a separate confirmation step.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: references/setup-guide.md:22

Finding

Unpinned MCP Package Is Downloaded and Executed Through npx

Content

View full analysis

Vulnerability Details

File Location: references/setup-guide.md:22
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: High

Vulnerable Code Snippet:

json

"command": ["npx", "-y", "@modelcontextprotocol/server-puppeteer"],

Technical Analysis

The documented MCP configuration invokes npx with the -y option and identifies the Puppeteer MCP package without an exact version. Consequently, npm can resolve and execute the version currently associated with the package's mutable registry tag.

The package is not protected by an exact version constraint, committed lockfile, integrity hash, or manual review prompt. The -y argument further suppresses installation confirmation. If the package, its maintainer account, one of its transitive dependencies, or the package registry is compromised, hostile code could be delivered after this Skill has already been reviewed.

Because an MCP server is an executable local process rather than passive data, the downloaded package runs with the privileges and environment of the user launching Kilo.

Attack Path

1. An attacker compromises the referenced npm package, a transitive dependency, its publishing account, or the relevant registry resolution path.
2. The attacker publishes a malicious version that is selected by the unversioned package reference.
3. A user configures the MCP server according to the setup guide.
4. Kilo starts the server by running npx -y @modelcontextprotocol/server-puppeteer.
5. npx downloads and executes the attacker-controlled package without presenting an installation confirmation.
6. Malicious package initialization or server code runs locally with the invoking user's privileges.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the account running Kilo. Subject to operating-system permissions and sandboxing, the malicious dependency could read or modify pro ...[truncated 299 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the MCP package to a reviewed exact version instead of relying on a mutable registry tag.
• Resolve dependencies during a controlled installation process and commit an appropriate lockfile with integrity metadata.
• Verify package provenance, signatures, and integrity before deployment.
• Use a trusted internal registry or preinstalled, reviewed artifact where practical.
• Avoid npx -y for first-time or dynamically resolved execution. Require explicit review before installing or updating executable dependencies.
• Disable package lifecycle scripts where compatible with the package and deployment model.
• Run the MCP server in a sandbox or container with a restricted filesystem, minimal environment variables, limited network access, and no unnecessary credentials.
• Establish a controlled dependency-update process that includes security review before changing the pinned version.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:52

Finding

Unconditional Auto-Approval Removes Permission Boundaries for Agent Operations

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:52
Additional Locations: SKILL.md:18,30,35,43; references/setup-guide.md:27; references/workflow.md:13,23
Vulnerability Type: Unattended execution with broadly bypassed permission prompts
Risk Level: High

Vulnerable Code Snippet:

markdown

- **Use Auto-Approval**: Always include the `--auto` flag when running Kilo from OpenClaw to avoid hanging on permission prompts.

The same behavior is reinforced by the setup guide:

markdown

### Auto-Approval Mode
When running Kilo from OpenClaw, use the `--auto` flag to bypass interactive permission prompts.

Technical Analysis

The Skill instructs callers to always enable Kilo's auto-approval mode. This explicitly bypasses interactive permission prompts across the Skill's advertised coding, filesystem, MCP, and browser-automation capabilities.

Permission prompts are a security boundary for reviewing consequential operations before execution. Disabling them by default violates least-privilege principles and removes the opportunity to reject destructive, overbroad, or privacy-sensitive actions. The risk is amplified because task prompts may contain mistakes, untrusted repository content may influence an agent's decisions, and the dynamically loaded MCP server receives local execution capabilities.

Auto-approval is not itself proof of malicious behavior, but making it unconditional exposes sensitive operations without adequate authorization gates.

Attack Path

1. Kilo receives a mistaken, overbroad, or attacker-influenced task through the user prompt, repository content, browser content, or MCP output.
2. OpenClaw launches Kilo with --auto, as required by the Skill documentation.
3. Kilo proposes an operation that would ordinarily require interactive authorization, such as changing files, executing a command, accessing browser content, or invoking an MCP capability.
4. Auto ...[truncated 1115 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the instruction to always use --auto; make unattended approval an explicit, task-specific opt-in.
• Require interactive confirmation for command execution, destructive file changes, access to credentials or sensitive files, browser actions involving authenticated accounts, external publication, and network transmission of data.
• Define allowlists for permitted commands, filesystem roots, domains, and MCP tools.
• Run Kilo and all MCP servers under a dedicated low-privilege account or isolated container.
• Mount only the required project paths and use read-only mounts whenever modification is unnecessary.
• Provide short-lived, task-scoped credentials rather than exposing the user's complete environment.
• Separate low-risk operations that may be automatically approved from high-impact operations that always require confirmation.
• Log proposed and completed operations so unattended activity can be reviewed and attributed.
• Disable session reuse for sensitive tasks unless the retained context has been reviewed, and avoid exposing unrelated authenticated browser sessions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation promotes running Kilo with --auto for hands-free execution and later states to always include auto-approval, but provides no warning about the risks of unattended code, browser, or tool actions. Because this skill is specifically positioned as the 'hands' for another agent and can drive coding tasks, sessions, and MCP-integrated tools, always-on auto-approval reduces meaningful operator oversight and can amplify mistakes or unsafe prompts into real system or web actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly encourages unattended browser automation through Kilo and Puppeteer without any safety constraints, confirmation requirements, scope limits, or warnings about interacting with real websites and user data. In this context, the skill is designed as an execution orchestrator with browser and filesystem-adjacent capabilities, so normalizing hands-free web actions materially increases the risk of credential misuse, destructive form submissions, scraping of sensitive data, or unintended external side effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The guide explicitly recommends using Kilo's --auto flag to bypass interactive permission prompts, but does not warn that this disables a core safety control. In the context of a coding and browser-automation agent that can make multi-file edits and invoke MCP servers, normalizing auto-approval materially increases the chance of unauthorized file changes, command execution, or unsafe browser actions without user review.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 91% confidence

Finding

The documented 'Auto-approve' behavior enables autonomous decision-making by the execution agent without a human-in-the-loop for operational steps. In a skill that can refactor files, manage sessions, and drive browser automation through MCP servers, that autonomy materially increases risk because the agent may independently take actions with security or privacy consequences.

Content

Scanner excerpt · references/workflow.md (reported line 13)May include surrounding context.

md

### Role of the Hands (Kilo)
- **Execute** the heavy-lifting tasks (code, browser automation, file refactors).
- **Auto-approve** operations using the `--auto` flag.
- **Report** back detailed findings.

## Step-by-Step Task Execution

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The workflow explicitly instructs the agent to use --auto, which removes approval checkpoints for potentially sensitive actions such as file edits, browser automation, and tool use. In this skill's context, Kilo is described as the execution 'hands' for coding and browser tasks, so auto-approval increases the chance of unintended network access, unsafe file modification, or prompt-driven misuse without human review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The example command normalizes running browser automation against an external website with --auto, but provides no warning about network activity, website interaction, or possible side effects of autonomous browsing. Because this skill is specifically designed to orchestrate Puppeteer and MCP-backed browser actions, the lack of safeguards makes unsafe external interactions more likely.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.