Security audit

Fin Audit Automator

Security checks for vulnerabilities and agentic risk

Overview

This finance audit skill is not clearly malicious, but it overstates important security and compliance protections while storing identifiable local audit data.

Install only if you treat it as a local demo or prototype, not as a production compliance control. Review the local files it creates under ~/.openclaw, do not rely on its sandbox or tamper-proof log claims, and independently verify invoice and audit results before using them for financial or regulatory decisions.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Warning

Location: modules/sandbox.py:17
Finding: Sandbox Does Not Enforce Network or Process Isolation
Content: View full analysis
Any: """Execute a function in the sandbox""" try: self.enable_restrictions() result = func(*args, **kwargs) return result finally: gc.collect() self.disable_restrictions() def secure_execute(func: Callable, *args, **kwargs) -> Any: sandbox = SecureSandbox() return sandbox.execute(func, *args, **kwargs) ``` The main request path imports but does not use this function: ```python from sandbox import secure_execute def _audit(self, request_type: str, data: dict) -> Dict[str, Any]: if not HAS_MODULES: return {"success": False, "error": "Module not installed"} try: if request_type == "aml_check": return self._aml_check(data) elif request_type == "fapiao_check": return self._fapiao_check(data) elif request_type == "report_gen": return self._report_gen(data) else: return {"success": False, "error": "Unknown request type"} ``` ### Technical Analysis Clearing HTTP ...[truncated 1822 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: index.py:174
Finding: Audit Log Integrity Mechanism Is Forgeable and Is Not a Hash Chain
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: index.py:48
Finding: Unsanitized User Identifiers Permit Audit Log Injection
Content: View full analysis
Dict[str, Any]: """Process an audit request""" self._log_audit(f"REQUEST:{request_type}", user_id) ``` ```python def _log_audit(self, action: str, user_id: str): """Record audit log using a simple hash chain""" timestamp = datetime.now().isoformat() entry = f"{timestamp}|{action}|{user_id}" entry_hash = hashlib.sha256(entry.encode()).hexdigest()[:16] log_line = f"{entry}|{entry_hash}\n" with open(AUDIT_LOG_FILE, 'a', encoding='utf-8') as f: f.write(log_line) ``` The request entry point obtains the identifier from caller-provided context: ```python def on_audit_request(request_type: str, data: dict, context: dict = None) -> dict: """OpenClaw request entry point""" context = context or {} user_id = context.get("user_id", "") automator = FinAuditAutomator() return automator.process(request_type, data, user_id) ``` ### Technical Analysis The caller-controlled `user_id` is inserted directly into a delimiter-separated, newline-terminated log record. No character validation, escaping, structured serialization, or length limit is applied. An identifier containing newline characters can create additional apparent records. Pipe characters can alter field boundaries and confuse downstream parsers. The digest does not prevent this because it is calculated over the attacker-controlled content, and there is no canonical record parser or authenticated record framing. Exception text is also passed to the same logger at `index.py:126-127`, which can create a similar problem if an exception includes attacker-controlled text. ### Attack Path 1. A caller supplies a `context["user_id"]` containing pipe delimiters, newline characters, and text re ...[truncated 652 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: modules/report_generator.py:14
Finding: Untrusted Findings Permit Markdown and Report-Structure Injection
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (14)

Env Variable Harvesting

High

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
Content: Scanner excerpt · modules/sandbox.py (reported line 18)May include surrounding context.
python
"""安全执行沙箱""" def __init__(self): self.original_env = dict(os.environ) self.restricted = False def enable_restrictions(self):

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description and primary documentation are written as Chinese-first content for a general finance auditing skill, and the file does not state that the skill is limited to a China-specific deployment or provide any user opt-in for language/locale. Under the stated policy, forcing a specific language without user choice is a natural-language policy violation unless clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 72% confidence
Finding: Most user-facing descriptions, help text, errors, and output labels in this file are presented only in Chinese, with no mechanism to select language or confirm locale preference. This can violate language/locale policy when a skill implicitly forces a specific language for interaction without offering user choice.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill logs user-linked audit activity to a persistent file under the user's home directory, including request types and user identifiers, without any notice, consent, minimization, retention control, or access restriction. In a financial compliance context, this metadata can reveal sensitive usage patterns and identities, and local plaintext logs are vulnerable to unintended disclosure on shared systems or through backup/sync mechanisms.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The trial manager stores per-user usage data in a local JSON file keyed by user ID, again without disclosure or safeguards. Although this is not direct remote code execution, it creates unnecessary persistence of identifiable usage records and may expose user activity or allow tampering with entitlement state if the local file is accessible.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The module’s natural-language strings and docstrings are predominantly in Chinese, including the primary title and operational descriptions, while the file does not offer a language choice or explain that the skill is intentionally limited to a Chinese-speaking or region-specific context. This can violate a language/locale policy when users are not given opt-in or an explicit justification for the locale constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This code contains multiple user-facing strings, comments, docstrings, issue messages, and printed output in Chinese, and the module title presents the functionality in Chinese-first form. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy concern because users who do not read Chinese may receive validation results they cannot understand.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The function is presented as validating an invoice image via OCR, but it ignores the supplied image and returns hardcoded mock text. In a document-validation or compliance workflow, this can cause false approvals or denials based on fabricated data rather than the actual invoice, undermining any downstream financial or compliance controls.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This Python file contains natural-language strings for titles, section headers, recommendations, and disclaimers exclusively in Chinese, which effectively forces a specific language on output. The file does not offer a user-selectable locale or document that the skill is intentionally limited to a Chinese-language/regulatory context.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The docstring for secure_execute claims controls such as disabling network access except whitelisted internal networks, blocking system command execution, and protecting in-memory sensitive data, but the implementation only clears proxy-related environment variables and runs the function normally. This mismatch is dangerous because callers may trust the helper as an actual sandbox and execute untrusted code under a false security assumption, enabling code execution, filesystem access, subprocess invocation, and direct network use that bypasses proxies entirely.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The package description is written only in Chinese ("金融合规审计自动化技能"), which indicates a language-specific presentation without any accompanying option or note that users may choose another language. The policy requires flagging skills that force a specific language or locale absent explicit opt-in or justification.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The comments state that OCR is attempted when available, but the implementation only calls a mock OCR routine, which misrepresents the security and assurance properties of the validator. This discrepancy can mislead operators into trusting validation results for real invoices when no real document analysis occurred.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This code contains natural-language descriptions and user-facing text primarily in Chinese, including the module title, class docstring, and operational comments/messages. Under the policy rule, forcing a specific language without offering user choice or documenting a region-specific justification is a locale policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file contains user-facing natural-language text primarily in Chinese, including the module description and method docstrings, without indicating that users can choose their preferred language. This can violate a language/locale policy when a skill presents or enforces a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.