Security audit

katok

Security checks for vulnerabilities and agentic risk

Overview

This skill is for KakaoTalk automation, but it combines private-message access, real message sending, macOS Accessibility control, and an unpinned third-party CLI install without enough scoping or warnings.

Install only if you trust the katok CLI source and maintainer, and consider reviewing or pinning the Homebrew formula before use. Grant Accessibility permission only to a controlled terminal environment. Before any send action, explicitly confirm the exact chat name and message text, and limit reads to the minimum chat and message count needed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:99
Finding: Unpinned CLI Installation from a Third-Party Homebrew Tap## Vulnerability Details **File Location**: `SKILL.md:99` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ```bash brew install sunghyun-k/tap/katok ``` ### Technical Analysis The Skill directs users to install `katok` from a third-party personal Homebrew tap without pinning a release, commit, package digest, or checksum. The project contains only `SKILL.md`; it does not include the CLI source or another mechanism for auditing and verifying the installed implementation. Consequently, the code executed by the documented `katok` commands can change independently after this Skill has been reviewed. The exposure is amplified because the prerequisite instructions require the terminal or execution environment to have macOS Accessibility permission. The documented CLI functionality includes enumerating contacts and chats, reading messages, launching KakaoTalk, and sending messages. ### Attack Path 1. An attacker compromises the third-party Homebrew tap, its maintainer account, release infrastructure, or an upstream artifact referenced by its formula. 2. The attacker publishes or substitutes a malicious `katok` package while retaining the expected package and command names. 3. A user follows the Skill instructions and runs `brew install sunghyun-k/tap/katok`. 4. Homebrew installs the currently supplied package because the Skill specifies no trusted version or integrity digest. 5. The user invokes a legitimate-looking `katok` command in an environment granted macOS Accessibility permission. 6. The compromised binary can abuse the process's available permissions to inspect KakaoTalk UI content, perform unauthorized UI actions, or transmit messages under the user's account. This path is conditional on compromise or malicious control of the external dependency. The audited project does not itself contain evidence that the current third-party package is malicious. ### Impact Assessment Successful explo ...[truncated 518 chars]
Remediation: ## Remediation Suggestions - Reference a publicly auditable and trusted source repository for the CLI. - Pin installation to a reviewed release or immutable commit rather than installing the latest mutable package. - Publish and verify a cryptographic digest, such as SHA-256, for the expected artifact. - Document the package's provenance, signing process, maintainer identity, and update policy. - Prefer a trusted package source with signed artifacts and reproducible builds. - Review the Homebrew formula and all downloaded artifacts before recommending installation. - Grant Accessibility permission only to a dedicated, minimally privileged execution environment where feasible. - Require explicit user confirmation immediately before operations that send messages. - Clearly disclose that chat and contact data are processed by an externally installed executable whose implementation is not included in this Skill.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The description says the skill should be used whenever KakaoTalk-related work is needed, which is an overly broad activation trigger for a capability that can read contacts, enumerate chats, read message contents, and send messages. Broad activation increases the chance an agent invokes the skill in situations where the user did not clearly consent to exposing private communications or sending real messages.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The documentation describes using macOS accessibility automation to control KakaoTalk but does not prominently warn that the skill can access privacy-sensitive data including friend lists, chat room names, unread indicators, and message contents. In an agent setting, lack of this warning makes unintended collection or exposure of personal communications more likely.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The send command documentation shows that real messages can be transmitted to actual chats, but it does not warn that invocation causes an external side effect and may message the wrong recipient if the chat name is mistaken. In a conversational agent workflow, omission of a confirmation warning raises the risk of accidental, irreversible messages being sent on the user's behalf.