kimi-quota-monitor

• Outcome: Review
• Latest audit: May 29, 2026 at 9:37 PM UTC
• Version:
  1.0.0

Overview

This quota-monitoring skill appears purpose-aligned, but it asks users to handle live Kimi session credentials in plaintext and can run recurring reports to WeChat.

Review carefully before installing. Use only on a trusted machine, keep the script and kimi_cookies.json out of source control and backups, restrict file permissions, verify the WeChat target ID, and enable cron only if you intentionally want daily background reporting. Rotate or revoke Kimi credentials if these files may have been exposed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill directs users to run a Python script, use Playwright, configure cron, and invoke the openclaw CLI, which implies shell execution and possible file writes, yet the skill declares no permissions. That mismatch is a real security issue because it hides the skill's operational capabilities from reviewers and users, reducing informed consent and making misuse or unintended side effects harder to assess.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly instructs users to extract highly sensitive session cookies, access tokens, refresh tokens, and localStorage authentication data from a live browser session and place them into local files/script configuration. Even though it briefly says not to leak them, it normalizes insecure credential handling and creates a high risk of account takeover if the files, logs, backups, or the skill itself are exposed or mishandled.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script persists refreshed Kimi authentication cookies to disk, which can expose reusable session credentials if the host is compromised, the file permissions are weak, or the file is accidentally shared or backed up. In this skill's context, the file is explicitly handling live account authentication material, so silent persistence increases the chance of account takeover or unauthorized quota/account access.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The code sends account-related status messages to WeChat through an external CLI without any explicit privacy notice in the file. While the transmitted content is limited to quota usage and login-expiry state rather than raw tokens, it still discloses service usage metadata to a third-party messaging channel and could leak operational/account information to the wrong recipient if misconfigured.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly instructs operators to inject authentication material from cookies and localStorage, including access_token and refresh_token, into an automated browser session. Even though this is framed as functional setup guidance, it normalizes handling long-lived credentials without any warning about secure storage, redaction, least-privilege use, or the risk of account takeover if the files, logs, or host are compromised.

VirusTotal

64/64 vendors flagged this skill as clean.