Zk Bankir Monitor

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:54 AM UTC
• Version: 1.0.0

Overview

This monitoring skill is mostly understandable, but it contradicts its read-only claims by documenting a state-changing treasury decision request over unauthenticated plain HTTP.

Install only if you will use it against an isolated local ZK-Bankir development server or after removing the decision-creation example. Do not use it for production or remote treasury monitoring without HTTPS, authentication, explicit confirmation for any state-changing request, and clear limits on admin data and webhook destinations.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:59

Finding

Monitoring Skill Exposes an Unauthenticated State-Changing Decision API

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:20

Finding

Sensitive Treasury and Decision Data Is Transmitted over Unauthenticated Plain HTTP

Content

View full analysis

/dev/null) ``` ```bash BALANCES=$(curl -s "$ZK_BANKIR_HOST/api/v1/treasury/balances" -H "Accept: application/json" 2>/dev/null) ``` ```bash DECISIONS=$(curl -s "$ZK_BANKIR_HOST/api/v1/decisions" -H "Accept: application/json" 2>/dev/null) ``` ### Technical Analysis The Skill retrieves treasury balances, BTC and PUSD holdings, Kraken exchange status, decision history, decision amounts, and approval states through unauthenticated HTTP endpoints. Plain HTTP provides neither transport confidentiality nor server authentication. When the default loopback address is used on a trusted local machine, network exposure is reduced. However, the documentation explicitly permits users to configure another host, including a remote server, without requiring HTTPS. For remote or untrusted networks, an on-path attacker can observe requests and responses, alter financial data returned to the agent, impersonate the ZK-Bankir server, or modify state-changing requests. The use of `curl -s` suppresses diagnostic output, and the script does not use options such as `--fail`, e ...[truncated 1784 chars]

Remediation

View remediation

--max-time `. 8. Validate the scheme and destination of `ZK_BANKIR_HOST` before use, including after redirects; disable redirects unless required or restrict them to the same trusted HTTPS origin. 9. Avoid logging full financial responses and redact sensitive balances, identifiers, and decision details where possible. 10. Update the documentation to state that unauthenticated HTTP is suitable only for isolated local development and must not be used for production or remote monitoring. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Claiming the skill is 'read-only' while also documenting a write operation is a dangerous trust-boundary violation. Users and agents may authorize the skill with lower scrutiny, then unknowingly trigger decision creation against a treasury system.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill is presented as a monitoring/read-only capability, yet it includes a POST /api/v1/decisions example that creates a new decision entry. That mismatch can cause an operator or agent to perform state-changing treasury actions under the false assumption that the skill is safe and observational only.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Including bin/rails runner introduces local code-execution capability on the server filesystem, which is materially more privileged than ordinary API monitoring. In an agent context, this can expand the blast radius from read-only HTTP queries to arbitrary application-context command execution if instructions are generalized or misused.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The compliance section reinforces the false 'read-only' claim, increasing the chance that reviewers will trust the skill and skip deeper validation. In a financial context, contradictory claims around mutability are especially risky because they can mask unauthorized or accidental ledger changes.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill documents shell-capable operations (curl, jq, and a local bin/rails runner) but does not declare any tool scope or allowed-tools boundary. This weakens containment and makes it easier for an agent runtime to grant broader execution than users expect, especially in a skill handling treasury and admin endpoints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The POST example creates a decision entry but is presented inline without a clear warning that it changes system state. In a treasury workflow, even policy-gated requests can generate audit records, trigger approvals, or initiate downstream financial processes that the user did not intend.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The POST request transmits decision data to an external service endpoint over HTTP, and the prerequisites explicitly note there is no authentication layer yet. In context, this is more dangerous than ordinary telemetry because it sends state-changing financial instructions over an unauthenticated channel, enabling interception, tampering, or unauthorized local-network access.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

Create a new decision (policy-gated: auto <$1k, approval $1k-$10k, deny >$10k):

bash

curl -s -X POST http://ZK_BANKIR_HOST/api/v1/decisions \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d '{"decision":{"action":"BUY_BTC","amount":500}}' | jq .

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest says the treasury is monitored 'via API', but the hash-chain verification procedure is not an API call at all; it requires local code execution in the ZK-Bankir project directory on the server. That is a meaningful behavior mismatch because it expands from remote API monitoring to local host access and command execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Advertising Slack/Telegram webhook integration without warning about third-party data transmission can lead operators to exfiltrate balance, decision, or health data outside the primary environment. In a banking/treasury context, even monitoring metadata may be sensitive and should not be forwarded by default.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest frames this skill as monitoring a ZK-Bankir treasury via API, including health, balances, decision tracking, and hash-chain verification. While hash-chain verification is mentioned, this implementation performs it by changing into a local application directory and invoking bin/rails runner, which is a broader local code-execution capability rather than a simple API read or verification call.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

Documenting admin endpoint access without noting sensitivity can expose pending approvals and operational decision data to users or agents who may not understand the confidentiality implications. While this is not an exploit by itself, it encourages casual access to privileged monitoring surfaces.

Content

No source excerpt is available for this finding.