Ae1
High
- Category
- analysis-evasion
- Content
- `SKILL.md`: `https://yahaha-studio.github.io/kichi-forwarder/SKILL.md`
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Security audit
Kichi Forwarder
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed Kichi integration that sends short message/status previews to Kichi and stores local connection state for the avatar.
Install only if you want your OpenClaw companion connected to Kichi. After connection, short incoming-message previews go to the selected Kichi server, and enabling full guided setup can also send short assistant-response previews and add recurring heartbeat behavior. Review the proposed openclaw.json and HEARTBEAT.md changes before approving them, and remove the Kichi state directory/heartbeat section when uninstalling if you want stored identities and recurring behavior cleared.
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)
Context Leakage
High
- Category
- Data Exfiltration
- Content
Explain these effects before installing or connecting: - The plugin runs inside the OpenClaw Gateway. Once connected, its incoming-message hook reads message text and sends a short avatar bubble preview to the selected Kichi server. The preview is limited to 20 display-width units, including any truncation marker; CJK characters and emoji generally occupy two units. This incoming preview does not depend on `hooks.allowConversationAccess`. - With `plugins.entries.kichi-forwarder.hooks.allowConversationAccess: true`, the end-of-turn hook additionally receives conversation messages and extracts the last assistant response. It sends a preview limited to 10 display-width units and performs end-of-turn status synchronization. These hook notifications contain the notification type, avatar ID, authentication key, and optional preview; they do not send the full conversation message array. - Direct Kichi tools, including `kichi_join`, work without that conversation-access permission. Full guided setup includes the permission for assistant-response synchronization, but changes it only after the user reviews and confirms the proposed setting below. - Joining sends the requested avatar identity and companion profile to the selected Kichi server. The plugin stores environment state, host-specific `avatarId`/`authKey`, and up to 30 Kichi bot-to-bot messages under the current agent's OpenClaw user directory. Player chats are not stored in that bot-to-bot history file. - Full guided setup also includes a Kichi section in workspace `HEARTBEAT.md`. It persists across sessions and can direct future heartbeat runs to create notes and music recommendations, send bot messages, and control avatar actions using the existing heartbeat cadence. Show this file change and its ongoing effects for user confirmation before applying it.
- Confidence
- 93% confidence
- Finding
- The skill explicitly describes a plugin capability that can access conversation messages and extract the last assistant response for transmission to a remote Kichi server when `allowConversationAccess` is enabled. Even though it says the full conversation array is not sent and requires user confirmation, this still creates a real context-leakage risk because sensitive assistant output, message previews, avatar/auth metadata, and ongoing sync events leave the local trust boundary and are persisted or transmitted to an external service.
Natural-Language Policy Violations
Medium
- Confidence
- 95% confidence
- Finding
- The document states that when `llmRuntimeEnabled` is `false`, sync uses fixed English text. This is a natural-language locale constraint presented as a default behavior without any user language choice or documented justification for restricting output to English.
Session Persistence
Medium
- Category
- Rogue Agent
- Content
- Provide at least one setting. The server checks room permissions. - `sent: true` means the Kichi server forwarded the change. `confirmed: false` means the client has not confirmed applying it; describe the result as sent, not as a confirmed scene change. ### kichi_music_album_create ```text kichi_music_album_create(albumTitle: "Deep Focus Mix", musicTitles: ["Calm Time", "Surrounded by Silence"])
- Confidence
- 60% confidence
- Finding
- Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Static analysis
No suspicious patterns detected.