kimi engine: review pack travels via argv; adopt a private prompt input when the CLI supports one

[steipete]

Problem

The Kimi review engine passes the entire validated review pack as the value of -p/--prompt (autoreview run_kimi, the cmd = [kimi_bin, "--prompt", prompt, ...] construction). Process command lines are observable by other local users/processes on multi-user hosts (ps eww, /proc/<pid>/cmdline), so every diff/dataset byte that is not a TruffleHog-detected credential is exposed for the duration of the Kimi run. SKILL.md documents the argv budget (120 KiB POSIX / 30 KiB Windows), so this is a known tradeoff — but it is weaker than every other engine's private-file/stdin transport.

Constraint

Kimi Code CLI 0.31.1 offers no private prompt input for non-interactive runs: kimi --help shows only -p, --prompt <prompt>; there is no stdin mode, no prompt-file flag, and --agent-file is the trusted agent definition, not a user-prompt channel (routing the untrusted pack through it would blur the trust boundary the isolation design depends on).

Ask

When the Kimi CLI grows a private prompt path (stdin or file), switch the engine transport to it and drop the argv budgeting. Until then this issue records the accepted exposure: same-host process inspection during the run, on multi-user hosts, of non-credential review content (credentials remain blocked by the pre-send TruffleHog scan).

Flagged by ClawSweeper on openclaw/openclaw#130122 (mirror sync).

[clawsweeper]

Codex review: keeping this open for maintainer follow-up; there is still a little grit to resolve. Reviewed August 26, 2026, 9:37 AM ET / 13:37 UTC.

Summary
Keep open as a valid security-hardening record: current main deliberately passes Kimi’s review pack on argv, and no supported private upstream input path is established yet.

Reproducibility: yes. source reproducibly constructs the Kimi command with the full prompt as the --prompt argument; a live Kimi CLI run is not needed to establish that transport path.

Next step
No bounded repository repair is available until Kimi exposes and documents a private non-interactive prompt channel.

Security
Needs attention: The issue identifies a real review-content exposure through Kimi command-line arguments, pending a supported private transport.

Review details

Best possible solution:

When Kimi publishes a stable private prompt-input contract, replace argv transport and add an integration regression proving the prompt is absent from process arguments while the existing isolation remains intact.

Do we have a high-confidence way to reproduce the issue?

Yes, source reproducibly constructs the Kimi command with the full prompt as the --prompt argument; a live Kimi CLI run is not needed to establish that transport path.

Is this the best way to solve the issue?

Unclear today: a private upstream channel would be the right solution, but there is no established Kimi stdin or prompt-file contract to adopt, and --agent-file should not become an untrusted prompt channel.

AGENTS.md: found and applied where relevant.

Remaining risk / open question:

• A future stdin or file channel must be verified against Kimi’s documented contract and tested to keep the prompt out of argv without weakening the isolated-agent boundary.

Codex review notes: model internal, reasoning high; reviewed against 52b1a0aef95a.

Label changes

Label changes:

• add P2: This is a bounded hardening gap affecting Kimi review runs, with no supported private upstream transport available today.
• add impact:security: The current Kimi invocation places non-credential review content in a process argument visible according to host process-inspection policy.
• add issue-rating: 🦞 diamond lobster: Current issue advisory state selects this label.
• add clawsweeper:source-repro: Current issue advisory state selects this label.
• add clawsweeper:no-new-fix-pr: Current issue advisory state selects this label.
• add clawsweeper:needs-security-review: Current issue advisory state selects this label.

Label justifications:

• P2: This is a bounded hardening gap affecting Kimi review runs, with no supported private upstream transport available today.
• impact:security: The current Kimi invocation places non-credential review content in a process argument visible according to host process-inspection policy.

Evidence reviewed

Security concerns:

• [medium] Review content is passed through process arguments — skills/autoreview/scripts/autoreview:4774
  The Kimi command receives the review pack as the value of --prompt; host process-inspection policy can expose that non-credential content during execution.
  Confidence: 0.98

What I checked:

• Current argv transport: Current main constructs the Kimi command with --prompt followed by the complete review prompt, so the reported transport is present. (skills/autoreview/scripts/autoreview:4772, 52b1a0aef95a)
• Explicit current constraint: The implementation documents that Kimi has no stdin mode and applies a platform-safe argv budget; the skill documentation repeats this as the current isolation tradeoff. (skills/autoreview/scripts/autoreview:157, 52b1a0aef95a)
• CLI-boundary validation: Kimi compatibility checking requires the current isolation flags including --prompt, but does not recognize a private prompt-input flag. (skills/autoreview/scripts/autoreview:3618, 52b1a0aef95a)
• Regression coverage: The Kimi unit test observes the spawned command and asserts that the review prompt is the value immediately following --prompt. (skills/autoreview/scripts/autoreview_test.py:928, 52b1a0aef95a)
• Feature provenance: History identifies the Kimi engine introduction and the later retargeting to the real CLI contract as the relevant ownership trail. (skills/autoreview/scripts/autoreview:4743, a504fd8ef2e7)
• Vision fit: VISION.md allows provider-specific behavior when its real contract is documented and tested directly, which is the necessary boundary for a future Kimi transport change. (VISION.md:11, 52b1a0aef95a)

Likely related people:

• steipete: Peter Steinberger introduced the Kimi reviewer and then retargeted it to the real 0.30+ Kimi CLI contract. (role: Kimi engine introducer and recent contract owner; confidence: high; commits: 7ae92605c023, a504fd8ef2e7; files: skills/autoreview/scripts/autoreview, skills/autoreview/SKILL.md)

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[steipete]

Current-main follow-up: this should remain open for a renewed maintainer security decision. The Kimi runner still passes the review pack as the --prompt argument, but the issue's statement that credentials are blocked by a pre-send TruffleHog scan no longer describes main.

Commit fe73c380c0faeff30b52e01376f7de7b47d8dd60 (#209) removed the external scanner and moved credential inspection into the reviewer. I verified its raw parent (6cd3366b10e2a8c5608265f692acf9f5da2b2448) and the parent-to-commit patch. Sensitive-path exclusions remain, but they do not establish that arbitrary diff content is credential-free before the Kimi process starts.

The current official CLI reference still documents prompt arguments for non-interactive runs: https://www.kimi.com/code/docs/en/kimi-code-cli/reference/kimi-command . Kimi is not installed on this review host, so I have no live private-transport proof and made no transport or policy change. The next decision is whether the accepted argv-exposure statement should be revised for the current credential-checking model while waiting for a supported private prompt channel.

[steipete]

Current upstream evidence changes the transport premise of this issue. The published kimi-cli==1.50.0 wheel exposes --input-format for use with --print and piped stdin. In kimi_cli/ui/print/__init__.py, lines 73–75 read sys.stdin.read().strip() when no prompt argument is supplied and text input is selected. The same path logs the command, so private runtime-log placement and cleanup need to be verified as part of the transport change.

Source: https://pypi.org/project/kimi-cli/1.50.0/ (published September 1, 2026). I inspected the published wheel without installing or executing it. This is source evidence, not a native Kimi/provider proof; Kimi is not installed on this validation host.

Also, current main b06d2bd0532666230916ca82f4cb55818ce6e500 again performs mandatory TruffleHog pre-send scans, restored in #212. The prior comment describing scanner removal is historical, rather than the present state.

Recommendation: validate the supported stdin route with the real isolated CLI, require its capability instead of silently falling back to argv, and verify prompt absence from process arguments plus private log cleanup. Keep this issue open until that runtime boundary is proved.