Grades are a hygiene check, not a security guarantee.

Claude Code, Skill

kyvault

使用 kyvault (或快捷短命令 ky) 在本地与 GitLab 团队环境中端对端管理加密 API Key、服务器资产台账与多 Profile 凭证。支持 Claude、Codex、Gemini 与 Hermes 全自动读写与子进程安全注入。

Compatibility: Not stated.

Grade D

Two or more Medium findings, or a High finding. Only try it in a sandbox.

Graded by PlugVetRubric v2

Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.

Rescanned at commit b0638bd7a1c9.

INSTALL_REMOTE_SCRIPT SECRETS_PATH_CREDENTIAL

Why this grade

  • INSTALL_REMOTE_SCRIPT High

    Fetches a script from the network and runs it (a pipe to a shell, or an install hook with a URL).

    rust/src/update.rs, line 107 "install.sh 退出码 {:?} —— 手动重试：curl -fsSL {INSTALL_SH} | bash",

  • SECRETS_PATH_CREDENTIAL Medium

    Mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc).

    rust/src/auth_guard.rs, line 441 println!("\n⚠️ ~/.ssh/ 下没有找到 .pub 公钥文件。");

Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.

If you think this grade is wrong, email [email protected] with the entry link and your evidence. We aim to acknowledge within two working days and decide within seven. If we confirm an error, we aim to correct it within 24 hours of confirming it. These are aims, not guarantees.

Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.

What was checked

Plain notes from the hygiene checks.

  • Permissions

    Note

    requests shell access. The manifest names this permission.

    PERMISSION_SHELL_DECLARED

    tools/import-chrome-csv.py, line 40

    r = subprocess.run(["kyvault", "list"], capture_output=True, text=True)

    tools/import-chrome-csv.py, line 71

    p = subprocess.run(

  • Install and update

    Serious

    install fetches a script from the network. The docs document an installer that pipes a download into a shell.

    INSTALL_REMOTE_SCRIPT INSTALL_DOCUMENTED_INSTALLER

    rust/src/update.rs, line 107

    "install.sh 退出码 {:?} —— 手动重试：curl -fsSL {INSTALL_SH} | bash",

    README.en.md, line 54

    curl -fsSL https://raw.githubusercontent.com/webkubor/kyvault/main/install.sh | bash

    README.md, line 54

    curl -fsSL https://raw.githubusercontent.com/webkubor/kyvault/main/install.sh | bash

    Show more

    docs/index.html, line 78

    <section class="install-section section" id="install" aria-labelledby="install-title"><div class="install-copy"><div class="section-kicker">GET STARTED</div><h2 id="install-title">

  • Network

    Concern

    can reach a host that is not written as a fixed address.

    NETWORK_NO_FIXED_HOST

    install.sh, line 77

    # 2026-09-10 实测：本机默认 curl 报 `(16) Error in the HTTP2 framing layer`，

    install.sh, line 81

    if ! curl -fsSL --retry 2 --retry-delay 1 "$url" -o "$tmp/pkg.tar.gz"; then

    install.sh, line 83

    if ! curl -fsSL --http1.1 --retry 2 --retry-delay 1 "$url" -o "$tmp/pkg.tar.gz"; then

    Show more

    rust/src/d1.rs, line 4

    //! 这里**没有 curl 兜底**，而 Python 版必须有。那段兜底存在的理由是一类真实故障：

    rust/src/d1.rs, line 6

    //! curl 连得通，唯独 Python 报 CERTIFICATE_VERIFY_FAILED，且跨解释器复现）。

    rust/src/ui.rs, line 401

    const catRes = await fetch('/api/categories');

    rust/src/ui.rs, line 406

    const statusRes = await fetch('/api/status');

    rust/src/ui.rs, line 473

    const res = await fetch('/api/set', {

  • Secrets

    Concern

    reads a credential or environment file.

    SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV

    rust/src/auth_guard.rs, line 441

    println!("\n⚠️ ~/.ssh/ 下没有找到 .pub 公钥文件。");

    rust/src/auth_guard.rs, line 477

    let rel = format!("~/.ssh/{fname}");

    rust/src/auth_guard.rs, line 600

    .ok_or_else(|| anyhow!("添加 SSH Key 需要指定公钥路径，如：kyvault auth add ssh ~/.ssh/id_ed25519.pub"))?;

    Show more

    rust/src/import_env.rs, line 1

    //! `kyvault import` —— 从 .env 批量导入密钥。

    rust/src/import_env.rs, line 7

    //! · **跳过空值**：`.env` 里 `FOO=` 这种占位行导进去只会污染库

    rust/src/main.rs, line 198

    /// 从 .env 批量导入密钥

    rust/src/main.rs, line 200

    #[arg(long, short = 'f', default_value = ".env")]

  • Agent instructions

    Pass

    No instruction to ignore earlier instructions or to hide a step.

  • Obfuscation

    Pass

    No encoded or minified payload found.

  • Licence

    Pass

    A licence file is present (LICENSE).

  • Maintainer activity

    Pass

    The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit b0638bd7a1c9. requests shell access. The manifest names this permission. install fetches a script from the network. can reach a host that is not written as a fixed address. reads a credential or environment file.

Date and source

Date checked:

View source

github.com

Commit graded: b0638bd7a1c9da0f76db0e875119768e3f917d25

This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.

Read how this letter is chosen