Security audit

Kichi Forwarder

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for a Kichi companion integration, but it asks for persistent workspace/config changes and even suggests cron-based reminders outside its own implemented capabilities.

Review this before installing if you are uncomfortable with a plugin enabling conversation-access hooks, writing persistent runtime identity files, editing workspace heartbeat/config files, posting notes/messages in Kichi, or prompting the agent to create OS-level cron reminders. Prefer approving any openclaw.json or HEARTBEAT.md edits manually and protect or remove the local kichi-world runtime directory if you uninstall or rotate identities.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The prompt explicitly instructs the agent to schedule a cron job for reminder requests, but this plugin does not implement any cron/reminder tool and only provides a visual clock that cannot notify users. In practice, the model may claim or imply a reminder was scheduled when no enforcement mechanism exists, creating a reliability and safety gap that can cause missed reminders or user harm when reminders are important.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README explicitly documents that host-specific auth keys are stored in local runtime files, but it does not warn users that these files are sensitive credentials or advise them to protect, restrict, or rotate them if exposed. If a local attacker, malware, backup leak, or accidental file sharing exposes these files, the auth keys could allow unauthorized connection or impersonation within the Kichi environment.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The document instructs the agent to modify a user workspace file (`HEARTBEAT.md`) during onboarding/install flow, but only frames it as a recommended operational step and does not require clear user consent or a prominent warning that the agent will edit user-owned files. This creates a risky pattern where an agent may silently persist behavior-changing instructions into the workspace, which can surprise users and expand the skill's influence beyond the immediate session.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill explicitly instructs the agent to modify workspace configuration (`openclaw.json`) and a workspace file (`HEARTBEAT.md`) as part of onboarding, but the document does not require explicit user confirmation immediately before those writes occur. Even though the changes are framed as installation steps, silently altering project files can violate user expectations, create persistence, and expand plugin capabilities such as conversation access.

Static analysis

No suspicious patterns detected.