kimu
Warn
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill identifies user intent and dynamically determines which instruction set to load and execute from local relative paths (e.g.,
../kimu-roundtable/SKILL.md). This runtime selection of logic modules constitutes dynamic execution from computed paths.- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process natural language user input to drive its routing logic, which creates a potential vulnerability surface for instructions embedded within the user data to influence the agent's behavior. - Ingestion points: User input captured via the
Kimu：{用户的问题或任务}natural language prefix described inSKILL.md. - Boundary markers: The skill specifies a natural language prefix as a start marker but lacks clear end-of-input delimiters or instructions for the agent to ignore potentially malicious commands nested within the user's task description.
- Capability inventory: The skill has the authority to load and switch the agent's context to any of the seven sub-modules listed in the "Module Map".
- Sanitization: There is no documented mechanism for sanitizing or validating user input before it is evaluated by the routing logic to decide which module to trigger.
Audit Metadata