kimi-datasource

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Runtime path: the Kimi Code host sends user-authored text into this skill, which then calls mcp__plugin-kimi-datasource_data__get_data_source_desc and mcp__plugin-kimi-datasource_data__call_data_source_tool and reads/returns the provider’s Markdown/text (e.g., descriptions and tool results) that are driven by the user’s selected data source and query parameters.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The runtime calls fetch(API_URL) to the Kimi Code backend (e.g. https://api.kimi.com/coding/v1) and uses the returned data-source Markdown (via get_data_source_desc) to decide APIs/params, and the code also contacts the OAuth host https://auth.kimi.com for credentials, so remote content at these URLs directly controls agent behavior at runtime.