kimi-quota-monitor

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:29 AM UTC
• Version: 1.0.0

Overview

This skill appears intended to monitor Kimi quota, but it asks users to store reusable login tokens and cookies in local files/source code and run an automated scheduled sender without enough safeguards.

Review carefully before installing. Only use this in a private, trusted environment, avoid committing the configured script or kimi_cookies.json, restrict file and log permissions, remove debug page-body logging, and understand that the cron job will repeatedly use your Kimi session and send reports through openclaw.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: fetch_quota.py:24

Finding

Plaintext authentication secrets and insufficiently protected session-cookie storage

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: SKILL.md:74

Finding

Unpinned Playwright dependency creates an avoidable supply-chain risk

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: fetch_quota.py:138

Finding

Authenticated page contents may be retained in cron logs

Content

View full analysis

document.body.innerText") print(f"[DEBUG] Page body preview: {body_text[:300]}") ``` The recommended scheduled-task configuration redirects all standard output and error output to a persistent file: ```text ### Configure scheduled task Add to crontab: ``` ```cron 8 7 * * * /usr/bin/python3 /path/to/kimi-quota-monitor/scripts/fetch_quota.py >> /path/to/logs/kimi_quota.log 2>&1 ``` ### Technical Analysis The script retrieves the complete visible text of an authenticated Kimi membership page and prints its first 300 characters. The exact contents are controlled by the current page layout and may include account, membership, quota, billing, or other user-specific information. The documentation then recommends running the script through cron while appending all output to `kimi_quota.log`. No restrictive file mode, log rotation, retention policy, or redaction requirement is specified. Consequently, authenticated page information may be retained indefinitely and exposed to other local users, backup systems, or log collectors. Capturing the page text is used for login-state detection, but printing an arbitrary preview is not required for quota monitoring or WeChat reporting. ### Attack Path 1. The user configures the documented cron entry. 2. The scheduled script authenticates to Kimi and loads the membership page. 3. The script reads `document.body.innerText` and writes the first 300 characters to standard output. 4. Shell redirection appends the text to `kimi_quota.log`. 5. The log receives permissive permissions, is copied to a centralized logging or ba ...[truncated 701 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (7)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill instructs users to run a Python script, write local credential material such as cookies JSON, and invoke shell commands like openclaw and cron, yet the manifest declares no explicit tool scope or permission boundaries. This creates an authorization gap where an agent could be induced to use file-write and shell-capable tooling without clear consent controls, especially dangerous because the workflow handles sensitive authentication tokens and external messaging.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger phrases are broad terms like 'Kimi额度' and '额度监控' without tight activation criteria, so the skill could activate in conversations that merely mention quotas rather than request automation. In this skill's context, mistaken activation is more dangerous because the documented workflow involves credential handling, shell commands, and possible outbound WeChat pushes.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest says the skill checks Kimi quota, configures automated daily push via openclaw, and troubleshoots quota fetching. While WeChat delivery is in scope, this implementation achieves it by spawning the openclaw executable through subprocess.run, which is a broader host-command execution capability not justified by the stated business purpose itself.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · fetch_quota.py (reported line 56)May include surrounding context.

python

"--message", message,
    ]
    try:
        subprocess.run(cmd, capture_output=True, timeout=30)
    except Exception as e:
        print(f"[ERROR] Push failed: {e}")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs storing and injecting sensitive authentication material, including cookies and localStorage tokens such as access_token and refresh_token, to automate access to a user account. This is dangerous because these credentials can be stolen from disk, logs, or misconfigured environments and reused to fully impersonate the user, and the document provides no safeguards, storage requirements, rotation guidance, or minimization controls.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The natural-language content is presented in Chinese and the file does not indicate that language selection is optional or based on user preference. Under the stated policy, forcing a specific language without user opt-in is a locale/language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code file contains user-facing documentation and runtime messaging that force a specific language/locale. The policy allows fixed locale only when the constraint is clearly documented and justified or when the user is offered a choice, which is not present here.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.