Kinthic is a local AI operator that can read files, browse the web, and, when enabled, execute terminal or code-edit actions. Treat it as powerful local software, not a passive chatbot.

By default Kinthic should run with:

• tool approvals enabled
• terminal execution disabled
• direct code application disabled
• background actions disabled
• Telegram deny-by-default until paired

High-risk areas:

• terminal execution
• code editing or repo writes
• browser/network actions
• Telegram access from unpaired users
• multi-process access to the same local SQLite brain

• Prefer one writer process per data directory.
• Pair Telegram with kinthic onboard or kinthic telegram run pairing protocol instead of enabling public mode.
• Review pending tool approvals via Telegram /approve or terminal before allowing high-impact actions.

Kinthic uses a strict pairing protocol for Telegram. Upon starting the bot daemon, you are given a 1-time PIN in the terminal. You must message this PIN to the Telegram bot to pair your user_id. Unpaired users cannot issue commands and are strictly rate-limited to 5 attempts per minute to prevent brute-forcing.

Destructive tools and skill generations are tagged with requires_approval=True. If you are operating via Telegram, the daemon halts execution and sends a pending request to your chat. You must manually send /approve before the agent can write to disk, run a terminal command, or use sensitive MCPs.

Skills downloaded from KinthicHub (kinthic skills install) can be flagged with a trust_level. Core and verified community skills are validated using an HMAC-SHA256 signature by the core team. To block all untrusted scripts, set KINTHIC_MEMORY_GUARD_STRICT=1 in your environment.

Please do not open a public issue for exploitable vulnerabilities that could affect users running Kinthic locally or remotely.

Instead, share:

• affected version or commit
• reproduction steps
• expected vs actual behavior
• impact assessment
• suggested mitigation, if known

Preferred path: use GitHub private vulnerability reporting for this repository if it is enabled.

If private reporting is not available yet, contact the maintainers at security@openyf.dev and avoid posting proof-of-concept details publicly.

If you are maintaining a fork, audit your own deployment defaults as well.

Status: Documented, backlogged. Low risk for local deployments.

The browser tool validates URLs by resolving the hostname and checking that all IP addresses are public (not private, loopback, or link-local). However, there is a time-of-check-to-time-of-use (TOCTOU) gap: the DNS could resolve differently between validation and the actual Playwright request.

An attacker with control of a DNS server could exploit this to make Silex browse internal network services (a DNS rebinding attack).

Why the risk is low:

• Silex binds to loopback by default — the attacker needs local access.
• The LLM chooses which URLs to browse, and the ethics engine evaluates the intent.
• The attack requires a malicious DNS server and a prompt injection that tricks the LLM into visiting the attacker's domain.

Future fix: Pin the resolved IP address and pass it to Playwright using --host-resolver-rules to enforce the validated address at the transport layer.

Status: Documented, warning implemented.

On Windows, ~/.kinthic/config/secrets.json has no file permission protection because Windows does not support Unix chmod. Any process running as the current user can read the file.

Mitigation: Kinthic logs a warning on Windows recommending environment variables (GEMINI_API_KEY, OPENAI_API_KEY, etc.) over the secrets file.

Status: Documented, backlogged. Non-issue in single-user mode.

When a user approves a pending tool action, the tool executes with the original arguments without re-checking ethics. In theory, if the database is writable by another process, the arguments could be modified between queuing and approval.

Why the risk is low: This only matters if the SQLite database is shared with another writer process, which is not the default configuration.

Future fix: Re-validate arguments and re-run the ethics check before executing approved tools.