ClawHub
Back to skill

Security audit

Kimiim

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Kimi group-chat CLI guidance skill with expected message, member, file, and workspace-memory behavior disclosed in the artifact.

Before installing, understand that this skill will guide the agent to read recent Kimi group context, member lists, shared files, and local group memory before replying, and it may send messages or attach files when working in that chat. Use it for intended Kimi group/session workflows, and be cautious if a task only loosely involves multi-agent collaboration outside Kimi IM.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The activation text is extremely broad and mandatory, requiring use of this skill for essentially any Kimi Group Chat, session, file, attachment, or multi-agent collaboration context. That can cause the agent to over-route tasks into this skill and automatically perform group-context reads or messaging behavior in situations where the scope is unclear, increasing the chance of unintended data access, context confusion, or inappropriate message/file handling across chats and threads.

Static analysis

No suspicious patterns detected.