Security audit

Kichi Forwarder

Security checks for vulnerabilities and agentic risk

Overview

The plugin is coherent for connecting an OpenClaw companion to Kichi, but it needs Review because it sends chat previews externally and includes under-scoped persistent behavior around reminders and heartbeat activity.

Review this before installing if you are comfortable with Kichi receiving short previews of incoming messages and assistant responses, local storage of avatar/auth state, and optional persistent heartbeat behavior that can post notes, recommend music, message bots, and react to user activity. Do not enable the heartbeat or conversation-access setup unless you want those ongoing behaviors, and treat the cron-reminder instruction as a point to constrain or remove if you do not want local scheduled jobs created by the agent.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · skills/kichi-forwarder/SKILL.md (reported line 15)May include surrounding context.
md
- `SKILL.md`: `https://yahaha-studio.github.io/kichi-forwarder/SKILL.md`

Context Leakage

High

Category: Data Exfiltration
Confidence: 85% confidence
Finding: Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.
Content: Scanner excerpt · skills/kichi-forwarder/references/install.md (reported line 53)May include surrounding context.
md
Explain these effects before installing or connecting: - The plugin runs inside the OpenClaw Gateway. Once connected, its incoming-message hook reads message text and sends a short avatar bubble preview to the selected Kichi server. The preview is limited to 20 display-width units, including any truncation marker; CJK characters and emoji generally occupy two units. This incoming preview does not depend on `hooks.allowConversationAccess`. - With `plugins.entries.kichi-forwarder.hooks.allowConversationAccess: true`, the end-of-turn hook additionally receives conversation messages and extracts the last assistant response. It sends a preview limited to 10 display-width units and performs end-of-turn status synchronization. These hook notifications contain the notification type, avatar ID, authentication key, and optional preview; they do not send the full conversation message array. - Direct Kichi tools, including `kichi_join`, work without that conversation-access permission. Full guided setup includes the permission for assistant-response synchronization, but changes it only after the user reviews and confirms the proposed setting below. - Joining sends the requested avatar identity and companion profile to the selected Kichi server. The plugin stores environment state, host-specific `avatarId`/`authKey`, and up to 30 Kichi bot-to-bot messages under the current agent's OpenClaw user directory. Player chats are not stored in that bot-to-bot history file. - Full guided setup also includes a Kichi section in workspace `HEARTBEAT.md`. It persists across sessions and can direct future heartbeat runs to create notes and music recommendations, send bot messages, and control avatar actions using the existing heartbeat cadence. Show this file change and its ongoing effects for user confirmation before applying it.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · skills/kichi-forwarder/SKILL.md (reported line 219)May include surrounding context.

Provide at least one setting. The server checks room permissions.

sent: true means the Kichi server forwarded the change.

kichi_music_album_create

text
kichi_music_album_create(albumTitle: "Deep Focus Mix", musicTitles: ["Calm Time", "Surrounded by Silence"])

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The snippet explicitly instructs the agent to remember and later recall observations about the current user, including activity, timer state, and time of day, across heartbeat runs. Persistent behavioral tracking creates privacy and profiling risk because it expands data retention beyond what is needed for the immediate task and could expose sensitive patterns about the user's habits or presence over time.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: L073 states that when llmRuntimeEnabled is false, sync uses fixed English text. This is a language-policy concern because the skill specifies a language choice unconditionally and does not indicate user choice or opt-in for that locale behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.