Security audit

Kiro Agent Chat

Security checks for vulnerabilities and agentic risk

Overview

This skill is a simple shared-file chat queue for agents; its behavior matches that purpose, but users should treat the shared queue as untrusted and not private.

Install only for low-trust-risk coordination where all agents and machines sharing the queue are already trusted. Do not put secrets in the queue, do not automatically execute messages as instructions, restrict filesystem or SSH access to the queue file, and expect possible message loss or corruption under concurrent use.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/send_message.py:10
Finding: Unauthenticated Shared Queue Enables Agent Impersonation, Disclosure, and Unauthorized Deletion
Content: View full analysis
2 else "" ``` ```python # Filter out deleted messages original_count = len(data.get("messages", [])) data["messages"] = [m for m in data.get("messages", []) if m.get("id") not in ids_to_delete] deleted_count = original_count - len(data["messages"]) with open(queue_file, 'w') as f: json.dump(data, f, indent=2) ``` ### Technical Analysis Agent identities are accepted directly from caller-controlled environment variables. Messages have no cryptographic signature or message authentication code, and readers do not verify that the claimed sender created a message. Likewise, `MY_NAME` is only a caller-selected string rather than an authenticated identity. Deletion is authorized solely by knowledge of a message ID and access to the queue file. The deletion script does not verify that the caller is the sender, intended receiver, or queue administrator. Messages are also stored as plaintext JSON, so confidentiality depends entirely on external files ...[truncated 2027 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/send_message.py:22
Finding: Unlocked Non-Atomic Queue Updates Permit Message Loss and JSON Corruption
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.
Content: Scanner excerpt · scripts/send_message.py (reported line 2)May include surrounding context.
python
#!/usr/bin/env python3 """Send message to agent chat queue.""" import json import os import sys

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill documents capabilities that read environment variables and perform file reads/writes, but it declares no explicit tool scope or permissions boundary. In an agent ecosystem, this increases the chance that the skill is invoked with broader-than-necessary access, enabling unintended access to shared files or environment-derived secrets.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documented deletion command permanently removes messages by ID without any warning, confirmation step, or guidance on safe use. In a shared queue used for inter-agent coordination, accidental or premature deletion can cause message loss, audit gaps, and denial of service for other agents relying on the queue.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code performs a destructive write that permanently removes messages from the JSON queue file, but it does not prompt for confirmation before applying the deletion. Although it logs the result afterward and the module docstring states its purpose, there is no user-facing warning before the irreversible action occurs.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The skill demonstrates remote SSH execution against another machine and a shared data file without warning about trust boundaries, credential handling, or command execution risk. While the example itself is straightforward, normalizing remote execution in a reusable skill can lead users or agents to run commands on unintended hosts or expose shared data across systems.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.