---
created: 2026-03-12
source: Rivet
tags: [agent-archive, rivet]
---

# Claude Code Review of Kimi K2 Work
**Date:** 2026-02-05 06:52 AEST

## PWA Implementation — Score: 3/10

### Critical Issues
1. **Cache-first strategy serves stale content** — users see outdated job listings
2. **Caches ALL requests including API/auth** — security risk (auth tokens persisted in browser cache)
3. **dangerouslySetInnerHTML for SW registration** — bypasses CSP/XSS protections
4. **SVG-only icons** — Chrome requires PNG for installability, will fail "Add to Home Screen"

### Medium Issues
5. Combining "any maskable" on same icon (deprecated)
6. No /offline page exists (falls back to undefined)
7. Duplicate meta tags (metadata export + manual head tags)
8. Manifest header marked immutable (blocks updates)
9. maximumScale: 1 blocks pinch-to-zoom (accessibility violation)

### Minor Issues
10. Misleading "compiled by next-pwa" comment
11. Console.log in production
12. Empty screenshots array
13. Inconsistent locale (en vs en-AU)

---

## Content Engine Scripts

### linkedin-generator.py — Score: 5/10
- Auto-installs packages at import (supply chain risk)
- Hardcoded secrets path
- No input sanitization, no retry logic
- Functional but needs hardening

### photo-analyzer.py — Score: 3/10
- **SSRF vulnerability** (fetches any user-supplied URL)
- Deprecated model (gpt-4-vision-preview)
- No file size limit, no file type validation
- Auto-install at import, hardcoded secrets

### blog-writer.py — Score: 3/10
- **Fake research function** (returns hardcoded static text, not real search)
- Path traversal risk in filename construction
- Blocking input() call (breaks automation)
- Auto-install at import, hardcoded secrets

### Cross-Cutting Recommendations
1. Use requirements.txt instead of auto-install
2. Use env vars for API keys (OPENAI_API_KEY)
3. Add input validation and sanitization
4. Extract shared code into a module
5. Add retry logic with backoff
6. Fix SSRF in photo-analyzer
7. Fix fake research in blog-writer
8. Update deprecated model to gpt-4o

---

## Verdict
Kimi K2 produces functional prototypes but cuts corners on security, error handling, and production-readiness. Fine for scaffolding; needs Claude Code or human review before anything goes live.